Spyware / Malware / Virus Removal

Fake Windos Restore took over laptop

10 min read

Looking for the outcome? Ask AI

ksc89 Topic Starter

Post #1April 17, 2011, 4:47 PM UTC

Hi,

My laptop has been taken over by a program called windows restore. This program was not downloaded by myself. Also, I keep getting pop-ups of random windows errors telling me I need to shut down the computer. Which my computer does also keep shutting down on its own. My program files are gone, I don't think they are deleted I believe they just may be hidden. All of my icons on my desktop are missing except for Internet Explorere and my recycle bin.
Thank you so much for your help!
Here is my hijack this log…

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:41:24 PM, on 4/17/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.17095)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\PROGRA~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE
C:\Program Files\Webroot\Security\Current\Framework\WRConsumerService.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\SigmaTel\C-Major Audio\DellXPM_5515v131\WDM\StacSV.exe
C:\Program Files\Spyware Doctor\pctsGui.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Webroot\Security\current\plugins\antimalware\AEI.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Webroot\Security\Current\Framework\WRTray.exe
C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter4.exe
C:\Program Files\AIM6\aim6.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\All Users\Application Data\HDFryVTMFjAtTWN.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Documents and Settings\All Users\Application Data\18407220.exe
C:\Program Files\internet explorer\iexplore.exe
C:\WINDOWS\system32\attrib.exe
C:\WINDOWS\system32\attrib.exe
C:\Documents and Settings\Ryan B\Local Settings\Temporary Internet Files\Content.IE5\FL0PZZ4A\HiJackThis[1].exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: (no name) - {472734EA-242A-422b-ADF8-83D1E48CC825} - (no file)
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [DLA] "C:\WINDOWS\System32\DLA\DLACTRLW.EXE"
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [SigmatelSysTrayApp] "%ProgramFiles%\SigmaTel\C-Major Audio\WDM\stsystra.exe"
O4 - HKLM\..\Run: [SynTPEnh] "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] "C:\WINDOWS\system32\WLTRAY.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsGui.exe" /hideGUI
O4 - HKLM\..\Run: [WebrootTrayApp] "C:\Program Files\Webroot\Security\Current\Framework\WRTray.exe"
O4 - HKLM\..\Run: [SpyHunter Security Suite] C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter4.exe
O4 - HKCU\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\PROGRA~1\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [HDFryVTMFjAtTWN] C:\Documents and Settings\All Users\Application Data\HDFryVTMFjAtTWN.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: SpyHunter 4 Service - Enigma Software Group USA, LLC. - C:\PROGRA~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Program Files\SigmaTel\C-Major Audio\DellXPM_5515v131\WDM\StacSV.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. (www.webroot.com) - C:\Program Files\Webroot\Security\current\plugins\antimalware\AEI.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE
O23 - Service: Webroot Client Service (WRConsumerService) - Webroot Software, Inc. - C:\Program Files\Webroot\Security\Current\Framework\WRConsumerService.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

–
End of file - 10087 bytes

mowman

Post #2April 17, 2011, 7:45 PM UTC

Hello,
Welcome to WhatTheTech. My name is mowman, and I will be helping you fix your problems.

If you do not make a reply in 3 days, we will have to close your topic.

You may want to keep the link to this topic in your favorites. Alternatively, you can click the Options button at the top bar of this topic and Track this topic. The topics you are tracking can be found by clicking on My Topics at the top of any page.

Please take note of some guidelines for this fix:

•Refrain from making any changes to your computer including installing/uninstall programs, deleting files, modifying the registry, and running scanners or tools. Doing so could cause changes to the directions I have to give you and prolong the time required. Further more, you should not be taking any advice relating to this computer from any other source throughout the course of this fix.
•If you do not understand any step(s) provided, please do not hesitate to ask before continuing. I would much rather clarify instructions or explain them differently than have something important broken.
•Even if things appear to be better, it might not mean we are finished. Please continue to follow my instructions and reply back until I give you the "all clean". We do not want to clean you part-way, only to have the system re-infect itself.
•Please reply using the button in the lower right hand corner of your screen. Do not start a new topic. The logs that you post should be pasted directly into the reply.
Only attach them if requested or if they do not fit into the post

Download This file and save to your desktop Double click on the icon to run the program.
If you cannot find the iExplore.exe icon that you downloaded, you can also execute the program by doing the following steps

Click on the Start button and then click on the Run menu option. In the Open: field enter %userprofile%\desktop\iexplore.exe and press the OK button. If you Windows prompts you to allow it to run, please allow it to do so.

Please be patient while the program looks for various malware programs and ends them. When it has finished, the black window will automatically close and you can continue with the next step

Next

Please download Malwarebytes from Here or Here

Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform quick scan, then click Scan.
[external image: Posted Image]
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected .
When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.

Post the log please

Next

Download OTL to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Under Custom Scan paste this in

netsvcs
drivers32
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\Fonts\*.exe
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
%PROGRAMFILES%\bak. /s
%systemroot%\system32\bak. /s
%ALLUSERSPROFILE%\Start Menu\*.lnk /x
%systemroot%\system32\config\systemprofile\*.dat /x
%systemroot%\*.config
%systemroot%\system32\*.db
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
%USERPROFILE%\Desktop\*.exe
%PROGRAMFILES%\Common Files\*.*
%systemroot%\*.src
%systemroot%\install\*.*
%systemroot%\system32\DLL\*.*
%systemroot%\system32\HelpFiles\*.*
%systemroot%\system32\rundll\*.*
%systemroot%\winn32\*.*
%systemroot%\Java\*.*
%systemroot%\system32\test\*.*
%systemroot%\system32\Rundll32\*.*
%systemroot%\AppPatch\Custom\*.*
%APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
%PROGRAMFILES%\PC-Doctor\Downloads\*.*
%PROGRAMFILES%\Internet Explorer\*.tmp
%PROGRAMFILES%\Internet Explorer\*.dat
%USERPROFILE%\My Documents\*.exe
%USERPROFILE%\*.exe
%systemroot%\ADDINS\*.*
%systemroot%\assembly\*.bak2
%systemroot%\Config\*.*
%systemroot%\REPAIR\*.bak2
%systemroot%\SECURITY\Database\*.sdb /x
%systemroot%\SYSTEM\*.bak2
%systemroot%\Web\*.bak2
%systemroot%\Driver Cache\*.*
%PROGRAMFILES%\Mozilla Firefox\0*.exe
%ProgramFiles%\Microsoft Common\*.*
%ProgramFiles%\TinyProxy.
%USERPROFILE%\Favorites\*.url /x
%systemroot%\system32\*.bk
%systemroot%\*.te
%systemroot%\system32\system32\*.*
%ALLUSERSPROFILE%\*.dat /x
%systemroot%\system32\drivers\*.rmv
dir /b "%systemroot%\system32\*.exe" | find /i " " /c
dir /b "%systemroot%\*.exe" | find /i " " /c
%PROGRAMFILES%\Microsoft\*.*
%systemroot%\System32\Wbem\proquota.exe
%PROGRAMFILES%\Mozilla Firefox\*.dat
%USERPROFILE%\Cookies\*.txt /x
%SystemRoot%\system32\fonts\*.*
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
You may need two posts to fit them both in.

ksc89

Post #3April 17, 2011, 9:32 PM UTC

I was unable at running any of the programs you wanted me to run. When I downloaded malwarebyte during the download it said "An error has occurred. Please report this error code to our support team. Program_error_ missing_file (2,0,mbamcore.ll) the system cannot find the sile specified. (That was in the middle of the download.) At the end of the download it said…"Access denied run-time error '53' file not found mbamcore. When I downloaded Explorere.exe program I was unable to open it. Lastly, The last file OTL downloaded successfully but when I run the scan my computer shuts down on its own… I'm not really sure what to do…. Thanks!!!!

ksc89

Post #4April 17, 2011, 11:00 PM UTC

After messing with my laptop for a while I was finally able to run the iexplorere.exe file which ended the malware applications…

I then tried to proceed with downloading malwarebytes again…which I was still unable to. The same alerts came up, still not allowing me to download it.

The last program (OTL) I was able to run that and get my report….here are both reports…

OTL logfile created on: 4/17/2011 6:48:59 PM - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Ryan B\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

894.00 Mb Total Physical Memory | 224.00 Mb Available Physical Memory | 25.00% Memory free
2.00 Gb Paging File | 1.00 Gb Available in Paging File | 61.00% Paging File free
Paging file location(s): C:\pagefile.sys 1344 2688 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 111.70 Gb Total Space | 83.42 Gb Free Space | 74.68% Space Free | Partition Type: NTFS

Computer Name: RYAN | User Name: Ryan B | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Ryan B\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Webroot\Security\Current\Framework\WRConsumerService.exe (Webroot Software, Inc. )
PRC - C:\Program Files\Webroot\Security\Current\Framework\WRTray.exe (Webroot Software, Inc. )
PRC - C:\Program Files\Webroot\Security\Current\plugins\antimalware\AEI.exe (Webroot Software, Inc. (www.webroot.com))
PRC - C:\Program Files\Spyware Doctor\pctsGui.exe (PC Tools)
PRC - C:\Program Files\Spyware Doctor\pctsSvc.exe (PC Tools)
PRC - C:\Program Files\Spyware Doctor\pctsAuxs.exe (PC Tools)
PRC - C:\Program Files\AIM6\aim6.exe (AOL LLC)
PRC - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited)
PRC - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
PRC - C:\Program Files\AIM6\aolsoftware.exe (AOL LLC)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\SigmaTel\C-Major Audio\DellXPM_5515v131\WDM\stacsv.exe (SigmaTel, Inc.)
PRC - C:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exe (SigmaTel, Inc.)
PRC - C:\Program Files\Viewpoint\Common\ViewpointService.exe (Viewpoint Corporation)
PRC - C:\WINDOWS\system32\DLA\DLACTRLW.EXE (Sonic Solutions)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Ryan B\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)
MOD - C:\Program Files\Spyware Doctor\PCTGMhk.dll (PC Tools)

========== Win32 Services (SafeList) ==========

SRV - (HidServ) – File not found
SRV - (WRConsumerService) – C:\Program Files\Webroot\Security\Current\Framework\WRConsumerService.exe (Webroot Software, Inc. )
SRV - (WebrootSpySweeperService) – C:\Program Files\Webroot\Security\current\plugins\antimalware\AEI.exe (Webroot Software, Inc. (www.webroot.com))
SRV - (sdCoreService) – C:\Program Files\Spyware Doctor\pctsSvc.exe (PC Tools)
SRV - (SpyHunter 4 Service) – C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe (Enigma Software Group USA, LLC.)
SRV - (sdAuxService) – C:\Program Files\Spyware Doctor\pctsAuxs.exe (PC Tools)
SRV - (YahooAUService) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
SRV - (STacSV) – C:\Program Files\SigmaTel\C-Major Audio\DellXPM_5515v131\WDM\stacsv.exe (SigmaTel, Inc.)
SRV - (Viewpoint Manager Service) – C:\Program Files\Viewpoint\Common\ViewpointService.exe (Viewpoint Corporation)

========== Driver Services (SafeList) ==========

DRV - (PCTCore) – C:\WINDOWS\system32\drivers\PCTCore.sys (PC Tools)
DRV - (SSIDRV) – C:\WINDOWS\SYSTEM32\Drivers\SSIDRV.SYS (Webroot Software, Inc. (www.webroot.com))
DRV - (SSFMONM) – C:\WINDOWS\system32\drivers\ssfmonm.sys (Webroot Software, Inc. (www.webroot.com))
DRV - (SSHRMD) – C:\WINDOWS\SYSTEM32\Drivers\SSHRMD.SYS (Webroot Software, Inc. (www.webroot.com))
DRV - (pctEFA) – C:\WINDOWS\system32\drivers\pctEFA.sys (PC Tools)
DRV - (pctDS) – C:\WINDOWS\system32\drivers\pctDS.sys (PC Tools)
DRV - (esgiguard) – C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys ()
DRV - (NwlnkIpx) – C:\WINDOWS\system32\drivers\nwlnkipx.sys (Microsoft Corporation)
DRV - (STHDA) – C:\WINDOWS\system32\drivers\sthda.sys (SigmaTel, Inc.)
DRV - (BCM43XX) – C:\WINDOWS\system32\drivers\BCMWL5.SYS (Broadcom Corporation)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (bcm4sbxp) – C:\WINDOWS\system32\drivers\bcm4sbxp.sys (Broadcom Corporation)
DRV - (rimmptsk) – C:\WINDOWS\system32\drivers\rimmptsk.sys (REDC)
DRV - (AmdK8) – C:\WINDOWS\system32\drivers\AmdK8.sys (Advanced Micro Devices)
DRV - (PCASp50) – C:\WINDOWS\system32\drivers\PCASp50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (NWADI) – C:\WINDOWS\system32\drivers\NWADIenum.sys (Novatel Wireless Inc)
DRV - (DLAUDFAM) – C:\WINDOWS\system32\DLA\DLAUDFAM.SYS (Sonic Solutions)
DRV - (DLAUDF_M) – C:\WINDOWS\system32\DLA\DLAUDF_M.SYS (Sonic Solutions)
DRV - (DLAIFS_M) – C:\WINDOWS\system32\DLA\DLAIFS_M.SYS (Sonic Solutions)
DRV - (DLABOIOM) – C:\WINDOWS\system32\DLA\DLABOIOM.SYS (Sonic Solutions)
DRV - (DLAOPIOM) – C:\WINDOWS\system32\DLA\DLAOPIOM.SYS (Sonic Solutions)
DRV - (DLAPoolM) – C:\WINDOWS\system32\DLA\DLAPoolM.SYS (Sonic Solutions)
DRV - (DLADResN) – C:\WINDOWS\system32\DLA\DLADResN.SYS (Sonic Solutions)
DRV - (DLACDBHM) – C:\WINDOWS\system32\drivers\DLACDBHM.SYS (Sonic Solutions)
DRV - (DLARTL_N) – C:\WINDOWS\system32\drivers\DLARTL_N.SYS (Sonic Solutions)
DRV - (NwlnkNb) – C:\WINDOWS\system32\drivers\nwlnknb.sys (Microsoft Corporation)
DRV - (NwlnkSpx) – C:\WINDOWS\system32\drivers\nwlnkspx.sys (Microsoft Corporation)
DRV - (ADM8511) – C:\WINDOWS\system32\drivers\ADM8511.SYS (ADMtek Incorporated)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\..\URLSearchHook: {472734EA-242A-422b-ADF8-83D1E48CC825} - Reg Error: Key error. File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

FF - HKLM\software\mozilla\Mozilla Firefox 3.5.18\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/03/27 14:29:55 | 000,000,000 | -H-D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.18\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/03/23 14:24:54 | 000,000,000 | -H-D | M]

[2009/10/26 14:16:37 | 000,000,000 | -H-D | M] (No name found) – C:\Documents and Settings\Ryan B\Application Data\Mozilla\Extensions
[2011/04/17 18:47:54 | 000,000,000 | -H-D | M] (No name found) – C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\extensions
[2009/12/02 22:23:30 | 000,000,000 | -H-D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/04/17 18:48:04 | 000,000,000 | —D | M] (Support.com Toolbar) – C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\extensions\[removed]
[2011/04/17 12:15:35 | 000,000,000 | -H-D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2010/01/23 19:10:11 | 000,000,000 | -H-D | M] (Move Media Player) – C:\DOCUMENTS AND SETTINGS\RYAN B\APPLICATION DATA\MOVE NETWORKS
[2009/09/12 22:08:29 | 000,000,000 | -H-D | M] (Java Quick Starter) – C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2007/04/16 13:07:12 | 000,180,293 | -H– | M] () – C:\Program Files\Mozilla Firefox\plugins\npViewpoint.dll

O1 HOSTS File: ([2011/04/08 13:48:33 | 000,000,027 | -H– | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (&Yahoo;! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\DLA\DLASHX_W.DLL (Sonic Solutions)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE (Sonic Solutions)
O4 - HKLM..\Run: [ISTray] C:\Program Files\Spyware Doctor\pctsGui.exe (PC Tools)
O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exe (SigmaTel, Inc.)
O4 - HKLM..\Run: [SpyHunter Security Suite] C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter4.exe (Enigma Software Group USA, LLC.)
O4 - HKLM..\Run: [WebrootTrayApp] C:\Program Files\Webroot\Security\Current\Framework\WRTray.exe (Webroot Software, Inc. )
O4 - HKCU..\Run: [Aim6] C:\Program Files\AIM6\aim6.exe (AOL LLC)
O4 - HKCU..\Run: [HDFryVTMFjAtTWN] C:\Documents and Settings\All Users\Application Data\HDFryVTMFjAtTWN.exe (WinSCP)
O4 - HKCU..\Run: [Messenger (Yahoo!)] C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited)
O4 - HKCU..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe ()
O4 - HKLM..\RunOnce: [InnoSetupRegFile.0000000001] C:\WINDOWS\is-2H2SU.exe ()
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware (registration)] C:\Program Files\Malwarebytes' Anti-Malware\mbamext.dll (Malwarebytes Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000026 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_15)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\Ryan B\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Ryan B\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O30 - LSA: Authentication Packages - (nwprovau) - C:\WINDOWS\System32\nwprovau.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/08/19 20:33:20 | 000,000,000 | -H– | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O33 - MountPoints2\{be095d3f-9104-11de-9199-0019b98268b2}\Shell - "" = AutoRun
O33 - MountPoints2\{be095d3f-9104-11de-9199-0019b98268b2}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{be095d3f-9104-11de-9199-0019b98268b2}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: HidServ - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax ()
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll ()

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (58560405907177472)

========== Files/Folders - Created Within 30 Days ==========

[2011/04/17 18:47:54 | 000,000,000 | —D | C] – C:\Program Files\Ask.com
[2011/04/17 18:46:50 | 005,689,312 | —- | C] (Support.com ) – C:\Documents and Settings\Ryan B\Desktop\ARO2011_tbt.exe
[2011/04/17 18:45:01 | 000,020,952 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2011/04/17 18:39:54 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Ryan B\Recent
[2011/04/17 16:45:02 | 000,580,608 | -H– | C] (OldTimer Tools) – C:\Documents and Settings\Ryan B\Desktop\OTL.exe
[2011/04/17 16:40:39 | 007,734,240 | -H– | C] (Malwarebytes Corporation ) – C:\Documents and Settings\Ryan B\Desktop\mbam-setup.exe
[2011/04/12 23:41:35 | 000,000,000 | -H-D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Spybot - Search & Destroy
[2011/04/12 23:41:27 | 000,000,000 | -H-D | C] – C:\Program Files\Spybot - Search & Destroy
[2011/04/12 23:41:27 | 000,000,000 | -H-D | C] – C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
[2011/04/12 22:26:14 | 000,000,000 | -H-D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\GridinSoft
[2011/04/12 22:25:50 | 000,000,000 | -H-D | C] – C:\Program Files\GridinSoft Trojan Killer
[2011/04/12 14:01:55 | 000,000,000 | -H-D | C] – C:\32788R22FWJFW
[2011/04/12 13:18:06 | 000,656,320 | -H– | C] (PC Tools) – C:\WINDOWS\System32\drivers\pctEFA.sys
[2011/04/12 13:18:06 | 000,338,880 | -H– | C] (PC Tools) – C:\WINDOWS\System32\drivers\pctDS.sys
[2011/04/12 13:17:53 | 000,000,000 | -H-D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\PC Tools Security
[2011/04/12 12:46:48 | 000,000,000 | -HSD | C] – C:\WINDOWS\CSC
[2011/04/12 12:40:35 | 000,000,000 | -H-D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\SpywareBlaster
[2011/04/12 12:40:33 | 000,000,000 | -H-D | C] – C:\Program Files\SpywareBlaster
[2011/04/12 01:53:31 | 000,000,000 | -H-D | C] – C:\Documents and Settings\Ryan B\Start Menu\Programs\SpyHunter
[2011/04/12 01:53:27 | 000,000,000 | -H-D | C] – C:\sh4ldr
[2011/04/12 01:53:27 | 000,000,000 | -H-D | C] – C:\Program Files\Enigma Software Group
[2011/04/12 01:53:01 | 000,000,000 | -H-D | C] – C:\Program Files\Common Files\Wise Installation Wizard
[2011/04/12 01:31:45 | 000,000,000 | -H-D | C] – C:\Documents and Settings\Ryan B\Start Menu\Programs\Windows Restore
[2011/04/12 01:16:49 | 000,557,056 | -H– | C] (WinSCP) – C:\Documents and Settings\All Users\Application Data\HDFryVTMFjAtTWN.exe
[6 C:\Documents and Settings\Ryan B\My Documents\*.tmp files -> C:\Documents and Settings\Ryan B\My Documents\*.tmp -> ]
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[13 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/04/17 18:48:02 | 000,000,236 | —- | M] () – C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2011/04/17 18:46:50 | 005,689,312 | —- | M] (Support.com ) – C:\Documents and Settings\Ryan B\Desktop\ARO2011_tbt.exe
[2011/04/17 18:45:17 | 000,709,456 | —- | M] () – C:\WINDOWS\is-2H2SU.exe
[2011/04/17 18:45:17 | 000,010,562 | —- | M] () – C:\WINDOWS\is-2H2SU.msg
[2011/04/17 18:45:17 | 000,000,415 | —- | M] () – C:\WINDOWS\is-2H2SU.lst
[2011/04/17 18:31:08 | 000,000,886 | -H– | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/04/17 18:23:24 | 000,002,206 | -H– | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/04/17 18:23:12 | 000,000,882 | -H– | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/04/17 18:22:01 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/04/17 17:36:30 | 000,000,336 | -H– | M] () – C:\Documents and Settings\All Users\Application Data\19783476
[2011/04/17 17:04:57 | 000,479,232 | -H– | M] () – C:\Documents and Settings\All Users\Application Data\19783476.exe
[2011/04/17 16:45:05 | 000,580,608 | -H– | M] (OldTimer Tools) – C:\Documents and Settings\Ryan B\Desktop\OTL.exe
[2011/04/17 16:40:39 | 007,734,240 | -H– | M] (Malwarebytes Corporation ) – C:\Documents and Settings\Ryan B\Desktop\mbam-setup.exe
[2011/04/17 16:35:06 | 001,006,778 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\new1.exe
[2011/04/17 16:35:06 | 001,006,778 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\new.exe
[2011/04/15 18:30:59 | 000,000,336 | -H– | M] () – C:\Documents and Settings\All Users\Application Data\18407220
[2011/04/13 09:15:24 | 000,000,096 | -H– | M] () – C:\Documents and Settings\All Users\Application Data\~19455796
[2011/04/13 09:15:23 | 000,000,128 | -H– | M] () – C:\Documents and Settings\All Users\Application Data\~19455796r
[2011/04/13 07:55:56 | 000,000,811 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\Windows Restore.lnk
[2011/04/13 07:55:52 | 000,000,336 | -H– | M] () – C:\Documents and Settings\All Users\Application Data\19455796
[2011/04/12 23:41:35 | 000,000,951 | -H– | M] () – C:\Documents and Settings\Ryan B\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2011/04/12 23:41:35 | 000,000,933 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\Spybot - Search & Destroy.lnk
[2011/04/12 23:12:45 | 000,000,832 | -H– | M] () – C:\Documents and Settings\Ryan B\Application Data\Microsoft\Internet Explorer\Quick Launch\Trojan Killer.lnk
[2011/04/12 23:12:45 | 000,000,814 | -H– | M] () – C:\Documents and Settings\All Users\Desktop\Trojan Killer.lnk
[2011/04/12 13:18:28 | 000,658,488 | -H– | M] () – C:\WINDOWS\System32\drivers\Cat.DB
[2011/04/12 13:17:54 | 000,001,637 | -H– | M] () – C:\Documents and Settings\All Users\Desktop\Spyware Doctor.lnk
[2011/04/12 13:14:50 | 000,512,992 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\sdasetup_revwire207.exe
[2011/04/12 12:40:35 | 000,000,690 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\SpywareBlaster.lnk
[2011/04/12 01:53:32 | 000,001,975 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\SpyHunter.lnk
[2011/04/12 01:16:49 | 000,557,056 | -H– | M] (WinSCP) – C:\Documents and Settings\All Users\Application Data\HDFryVTMFjAtTWN.exe
[2011/04/12 00:51:16 | 000,046,471 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\myc.jpg
[2011/04/11 16:08:47 | 000,435,828 | -H– | M] () – C:\WINDOWS\System32\perfh009.dat
[2011/04/11 16:08:47 | 000,068,558 | -H– | M] () – C:\WINDOWS\System32\perfc009.dat
[2011/03/28 22:26:50 | 005,084,128 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\03-young-modern-life.mp3
[2011/03/25 19:07:05 | 000,027,356 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\schoolpicture.jpg
[2011/03/23 14:39:59 | 000,030,756 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\after gym.jpg
[2011/03/21 23:33:04 | 000,021,652 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\me4.jpg
[2011/03/20 11:12:29 | 003,128,890 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\2011 Returning Info Form_distributed.pdf
[6 C:\Documents and Settings\Ryan B\My Documents\*.tmp files -> C:\Documents and Settings\Ryan B\My Documents\*.tmp -> ]
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[13 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/04/17 18:48:01 | 000,000,236 | —- | C] () – C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2011/04/17 18:45:17 | 000,709,456 | —- | C] () – C:\WINDOWS\is-2H2SU.exe
[2011/04/17 18:45:17 | 000,010,562 | —- | C] () – C:\WINDOWS\is-2H2SU.msg
[2011/04/17 18:45:17 | 000,000,415 | —- | C] () – C:\WINDOWS\is-2H2SU.lst
[2011/04/17 18:34:56 | 001,006,778 | -H– | C] () – C:\Documents and Settings\Ryan B\Desktop\new1.exe
[2011/04/17 17:36:30 | 000,000,336 | -H– | C] () – C:\Documents and Settings\All Users\Application Data\19783476
[2011/04/17 17:04:57 | 000,479,232 | -H– | C] () – C:\Documents and Settings\All Users\Application Data\19783476.exe
[2011/04/17 16:35:02 | 001,006,778 | -H– | C] () – C:\Documents and Settings\Ryan B\Desktop\new.exe
[2011/04/15 18:30:59 | 000,000,336 | -H– | C] () – C:\Documents and Settings\All Users\Application Data\18407220
[2011/04/13 09:15:23 | 000,000,128 | -H– | C] () – C:\Documents and Settings\All Users\Application Data\~19455796r
[2011/04/13 09:15:23 | 000,000,096 | -H– | C] () – C:\Documents and Settings\All Users\Application Data\~19455796
[2011/04/13 07:55:56 | 000,000,811 | -H– | C] () – C:\Documents and Settings\Ryan B\Desktop\Windows Restore.lnk
[2011/04/13 07:55:52 | 000,000,336 | -H– | C] () – C:\Documents and Settings\All Users\Application Data\19455796
[2011/04/12 23:41:35 | 000,000,951 | -H– | C] () – C:\Documents and Settings\Ryan B\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2011/04/12 23:41:35 | 000,000,933 | -H– | C] () – C:\Documents and Settings\Ryan B\Desktop\Spybot - Search & Destroy.lnk
[2011/04/12 23:12:45 | 000,000,832 | -H– | C] () – C:\Documents and Settings\Ryan B\Application Data\Microsoft\Internet Explorer\Quick Launch\Trojan Killer.lnk
[2011/04/12 22:26:19 | 000,000,814 | -H– | C] () – C:\Documents and Settings\All Users\Desktop\Trojan Killer.lnk
[2011/04/12 13:18:12 | 000,658,488 | -H– | C] () – C:\WINDOWS\System32\drivers\Cat.DB
[2011/04/12 13:17:54 | 000,001,637 | -H– | C] () – C:\Documents and Settings\All Users\Desktop\Spyware Doctor.lnk
[2011/04/12 13:14:59 | 000,512,992 | -H– | C] () – C:\Documents and Settings\Ryan B\Desktop\sdasetup_revwire207.exe
[2011/04/12 12:40:35 | 000,000,690 | -H– | C] () – C:\Documents and Settings\Ryan B\Desktop\SpywareBlaster.lnk
[2011/04/12 01:53:32 | 000,001,975 | -H– | C] () – C:\Documents and Settings\Ryan B\Desktop\SpyHunter.lnk
[2011/04/12 00:51:15 | 000,046,471 | -H– | C] () – C:\Documents and Settings\Ryan B\Desktop\myc.jpg
[2011/03/28 21:51:16 | 005,084,128 | -H– | C] () – C:\Documents and Settings\Ryan B\Desktop\03-young-modern-life.mp3
[2011/03/25 19:07:03 | 000,027,356 | -H– | C] () – C:\Documents and Settings\Ryan B\Desktop\schoolpicture.jpg
[2011/03/23 14:39:58 | 000,030,756 | -H– | C] () – C:\Documents and Settings\Ryan B\Desktop\after gym.jpg
[2011/03/21 23:33:03 | 000,021,652 | -H– | C] () – C:\Documents and Settings\Ryan B\Desktop\me4.jpg
[2011/03/20 11:12:28 | 003,128,890 | -H– | C] () – C:\Documents and Settings\Ryan B\Desktop\2011 Returning Info Form_distributed.pdf
[2010/10/02 12:55:56 | 000,030,424 | -H– | C] () – C:\WINDOWS\System32\wrLZMA.dll
[2010/10/02 12:55:56 | 000,017,472 | -H– | C] () – C:\WINDOWS\System32\SsiEfr.exe
[2010/03/02 01:35:11 | 000,006,144 | -H– | C] () – C:\Documents and Settings\Ryan B\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/12/12 15:11:10 | 000,261,632 | -H– | C] () – C:\WINDOWS\PEV.exe
[2009/12/12 15:11:10 | 000,098,816 | -H– | C] () – C:\WINDOWS\sed.exe
[2009/12/12 15:11:10 | 000,080,412 | -H– | C] () – C:\WINDOWS\grep.exe
[2009/12/12 15:11:10 | 000,077,312 | -H– | C] () – C:\WINDOWS\MBR.exe
[2009/12/12 15:11:10 | 000,068,096 | -H– | C] () – C:\WINDOWS\zip.exe
[2009/09/18 20:13:37 | 000,000,664 | -H– | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2009/08/24 19:36:03 | 000,000,000 | -H– | C] () – C:\WINDOWS\nsreg.dat
[2009/08/24 17:44:11 | 000,086,016 | -H– | C] () – C:\WINDOWS\System32\preflib.dll
[2009/08/24 17:44:09 | 000,020,480 | -H– | C] () – C:\WINDOWS\System32\WLTRYSVC.EXE
[2009/08/24 17:44:08 | 000,757,760 | -H– | C] () – C:\WINDOWS\System32\bcm1xsup.dll
[2009/08/24 16:22:09 | 003,107,788 | -H– | C] () – C:\WINDOWS\System32\ativvaxx.dat
[2009/08/24 16:22:09 | 000,147,685 | -H– | C] () – C:\WINDOWS\System32\atiicdxx.dat
[2009/08/19 21:30:17 | 000,000,174 | -H– | C] () – C:\WINDOWS\wininit.ini
[2009/08/19 20:36:41 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2009/08/19 20:29:30 | 000,021,640 | -H– | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2009/08/19 16:15:27 | 000,004,161 | -H– | C] () – C:\WINDOWS\ODBCINST.INI
[2009/08/19 16:07:20 | 000,267,800 | -H– | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2005/11/18 14:47:26 | 000,000,000 | -H– | C] () – C:\WINDOWS\System32\px.ini
[2005/03/21 19:48:05 | 013,107,200 | -H– | C] () – C:\WINDOWS\System32\oembios.bin
[2005/03/21 19:48:05 | 000,004,627 | -H– | C] () – C:\WINDOWS\System32\oembios.dat
[2004/08/04 06:00:00 | 000,755,200 | -H– | C] () – C:\WINDOWS\System32\ir50_32.dll
[2004/08/04 06:00:00 | 000,673,088 | -H– | C] () – C:\WINDOWS\System32\mlang.dat
[2004/08/04 06:00:00 | 000,435,828 | -H– | C] () – C:\WINDOWS\System32\perfh009.dat
[2004/08/04 06:00:00 | 000,338,432 | -H– | C] () – C:\WINDOWS\System32\ir41_qcx.dll
[2004/08/04 06:00:00 | 000,272,128 | -H– | C] () – C:\WINDOWS\System32\perfi009.dat
[2004/08/04 06:00:00 | 000,218,003 | -H– | C] () – C:\WINDOWS\System32\dssec.dat
[2004/08/04 06:00:00 | 000,200,192 | -H– | C] () – C:\WINDOWS\System32\ir50_qc.dll
[2004/08/04 06:00:00 | 000,183,808 | -H– | C] () – C:\WINDOWS\System32\ir50_qcx.dll
[2004/08/04 06:00:00 | 000,120,320 | -H– | C] () – C:\WINDOWS\System32\ir41_qc.dll
[2004/08/04 06:00:00 | 000,068,558 | -H– | C] () – C:\WINDOWS\System32\perfc009.dat
[2004/08/04 06:00:00 | 000,046,258 | -H– | C] () – C:\WINDOWS\System32\mib.bin
[2004/08/04 06:00:00 | 000,028,626 | -H– | C] () – C:\WINDOWS\System32\perfd009.dat
[2004/08/04 06:00:00 | 000,004,569 | -H– | C] () – C:\WINDOWS\System32\secupd.dat
[2004/08/04 06:00:00 | 000,001,804 | -H– | C] () – C:\WINDOWS\System32\dcache.bin
[2004/08/04 06:00:00 | 000,000,741 | -H– | C] () – C:\WINDOWS\System32\noise.dat

========== LOP Check ==========

[2009/08/24 23:11:17 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\acccore
[2011/01/27 23:22:05 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\Novatel Wireless
[2011/04/17 18:51:26 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2009/08/24 23:11:18 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\Viewpoint
[2010/10/02 12:53:03 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\{5D7316EC-0EDC-4C87-A589-9244C286BC92}
[2009/09/11 16:49:28 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/08/24 23:13:00 | 000,000,000 | -H-D | M] – C:\Documents and Settings\Ryan B\Application Data\acccore
[2011/04/08 02:51:10 | 000,000,000 | -H-D | M] – C:\Documents and Settings\Ryan B\Application Data\FrostWire
[2009/08/20 19:29:39 | 000,000,000 | -H-D | M] – C:\Documents and Settings\Ryan B\Application Data\Leadertech
[2009/10/07 16:05:49 | 000,000,000 | -H-D | M] – C:\Documents and Settings\Ryan B\Application Data\LimeWire
[2009/09/18 21:30:36 | 000,000,000 | -H-D | M] – C:\Documents and Settings\Ryan B\Application Data\Viewpoint
[2011/04/17 18:48:02 | 000,000,236 | —- | M] () – C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2009/08/19 20:33:20 | 000,000,000 | -H– | M] () – C:\AUTOEXEC.BAT
[2009/08/24 14:41:49 | 000,000,223 | -H– | M] () – C:\Boot.bak
[2009/12/12 15:12:25 | 000,000,293 | RHS- | M] () – C:\boot.ini
[2004/08/04 00:00:00 | 000,260,272 | -H– | M] () – C:\cmldr
[2010/03/10 02:31:14 | 000,039,395 | -H– | M] () – C:\ComboFix.txt
[2009/08/19 20:33:20 | 000,000,000 | -H– | M] () – C:\CONFIG.SYS
[2009/08/19 20:33:20 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2009/08/24 23:12:00 | 000,000,462 | -H– | M] () – C:\IPH.PH
[2009/08/19 20:33:20 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2004/08/04 06:00:00 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2009/08/24 13:56:08 | 000,250,048 | RHS- | M] () – C:\ntldr
[2011/04/17 18:21:42 | 1409,286,144 | -HS- | M] () – C:\pagefile.sys
[2011/04/17 18:41:27 | 000,000,564 | -H– | M] () – C:\rkill.log

< %systemroot%\Fonts\*.com >
[2006/04/18 15:39:28 | 000,026,040 | -H– | M] () – C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 14:53:56 | 000,026,489 | -H– | M] () – C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 15:39:28 | 000,029,779 | -H– | M] () – C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 14:58:52 | 000,030,808 | -H– | M] () – C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/08/19 20:32:48 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/07/06 08:06:10 | 000,089,088 | -H– | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2006/10/26 19:56:12 | 000,033,104 | -H– | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\msonpppr.dll
[2008/07/06 06:50:03 | 000,597,504 | -H– | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2009/08/19 16:06:13 | 000,094,208 | -H– | M] () – C:\WINDOWS\system32\config\default.sav
[2009/08/19 16:06:13 | 000,659,456 | -H– | M] () – C:\WINDOWS\system32\config\software.sav
[2009/08/19 16:06:13 | 000,901,120 | -H– | M] () – C:\WINDOWS\system32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2009/08/24 14:01:26 | 000,000,272 | -HS- | M] () – C:\Documents and Settings\All Users\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2009/08/24 14:26:44 | 000,000,119 | -HS- | M] () – C:\Documents and Settings\Ryan B\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2009/08/19 20:40:42 | 000,000,079 | -H– | M] () – C:\Documents and Settings\Ryan B\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >
[2010/03/10 02:22:31 | 003,885,183 | RH– | M] () – C:\Documents and Settings\Ryan B\Desktop\AB.exe.exe
[2011/04/17 18:46:50 | 005,689,312 | —- | M] (Support.com ) – C:\Documents and Settings\Ryan B\Desktop\ARO2011_tbt.exe
[2011/04/17 16:40:39 | 007,734,240 | -H– | M] (Malwarebytes Corporation ) – C:\Documents and Settings\Ryan B\Desktop\mbam-setup.exe
[2011/04/17 16:35:06 | 001,006,778 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\new.exe
[2011/04/17 16:35:06 | 001,006,778 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\new1.exe
[2011/04/17 16:45:05 | 000,580,608 | -H– | M] (OldTimer Tools) – C:\Documents and Settings\Ryan B\Desktop\OTL.exe
[2011/04/12 13:14:50 | 000,512,992 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\sdasetup_revwire207.exe
[2009/08/24 16:57:02 | 000,253,952 | -H– | M] (Phoenix Technologies, Ltd.) – C:\Documents and Settings\Ryan B\Desktop\WINPHLASH.EXE

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2009/08/24 14:26:44 | 000,000,122 | -HS- | M] () – C:\Documents and Settings\Ryan B\Favorites\Desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >
[2011/04/17 18:47:59 | 000,065,536 | -HS- | M] () – C:\Documents and Settings\Ryan B\Cookies\index.dat

< %SystemRoot%\system32\fonts\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-03-25 15:16:43

< >

========== Alternate Data Streams ==========

@Alternate Data Stream - 149 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2

< End of report >

And here is the Extras.txt…..

OTL Extras logfile created on: 4/17/2011 6:48:59 PM - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Ryan B\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

894.00 Mb Total Physical Memory | 224.00 Mb Available Physical Memory | 25.00% Memory free
2.00 Gb Paging File | 1.00 Gb Available in Paging File | 61.00% Paging File free
Paging file location(s): C:\pagefile.sys 1344 2688 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 111.70 Gb Total Space | 83.42 Gb Free Space | 74.68% Space Free | Partition Type: NTFS

Computer Name: RYAN | User Name: Ryan B | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.url [@ = InternetShortcut] – rundll32.exe ieframe.dll,OpenURL %l

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
htafile [open] – "%1" %*
InternetShortcut [open] – rundll32.exe ieframe.dll,OpenURL %l
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Common Files\AOL\Loader\aolload.exe" = C:\Program Files\Common Files\AOL\Loader\aolload.exe:*:Enabled:AOL Loader – (AOL LLC)
"C:\Program Files\AIM6\aim6.exe" = C:\Program Files\AIM6\aim6.exe:*:Enabled:AIM – (AOL LLC)
"C:\Program Files\FrostWire\FrostWire.exe" = C:\Program Files\FrostWire\FrostWire.exe:*:Enabled:FrostWire – (FrostWire Group)
"C:\WINDOWS\system32\java.exe" = C:\WINDOWS\system32\java.exe:*:Disabled:Java™ Platform SE binary – (Sun Microsystems, Inc.)
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" = C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger – (Yahoo! Inc.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{055EE59D-217B-43A7-ABFF-507B966405D8}" = ATI Catalyst Control Center
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{075473F5-846A-448B-BCB3-104AA1760205}" = Roxio RecordNow Data
"{0C34B801-6AEC-4667-B053-03A67E2D0415}" = Apple Application Support
"{0CCF6926-479F-FE86-FE27-9C944A8D242C}" = Catalyst Control Center Localization German
"{0FADBFEF-FC83-CC42-4951-E3D9FCFBB84F}" = Catalyst Control Center Graphics Full New
"{1206EF92-2E83-4859-ACCB-2048C3CB7DA6}" = Roxio DLA
"{14359DB5-5F07-6773-3E17-C7388229CCFC}" = CCC Help English
"{26A24AE4-039D-4CA4-87B4-2F83216015FF}" = Java™ 6 Update 15
"{2FA1A75E-AE60-FA59-D036-366D7F00B567}" = CCC Help French
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Sonic Update Manager
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{41EBC322-660F-4D16-A0DF-53147210CBDB}" = SpyHunter
"{4286E640-B5FB-11DF-AC4B-005056C00008}" = Google Earth
"{4EE78BB8-5538-1186-8EA8-F12BD40185F9}" = Catalyst Control Center Graphics Full Existing
"{611131AF-3475-B625-A987-9FBEA8584D39}" = Catalyst Control Center Localization Italian
"{612B9183-67A9-4B44-9877-2F059E35B86A}" = Broadcom 440x 10/100 Integrated Controller
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD 5.7
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6CCA5CB8-3332-D10A-96C4-B114C1D04704}" = Catalyst Control Center Graphics Light
"{6E0A0C2C-7D63-9786-6519-C94C9EC22599}" = Catalyst Control Center Localization Japanese
"{82E86238-89F5-758D-4B10-44229F980D2D}" = ccc-utility
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{8686D4FE-62EF-46FB-B9FD-00679EB381FF}_is1" = Trojan Killer 2.0
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8B287B75-DF8D-40C8-9620-8E4492C38EF1}" = Webroot Software
"{8CF86054-49F7-D6E0-078A-CF7E2C03F487}" = Catalyst Control Center Localization Spanish
"{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 12
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_ENTERPRISER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_ENTERPRISER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_ENTERPRISER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_ENTERPRISER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_ENTERPRISER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_ENTERPRISER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISER_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISER_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_ENTERPRISER_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}_ENTERPRISER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_ENTERPRISER_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_ENTERPRISER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
"{90120000-00BA-0409-0000-0000000FF1CE}_ENTERPRISER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
"{90120000-0114-0409-0000-0000000FF1CE}_ENTERPRISER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_ENTERPRISER_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_ENTERPRISER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{91120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{921F7EF3-D850-9CB6-2811-180F7AC1358B}" = Catalyst Control Center Localization Chinese Standard
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A429C2AE-EBF1-4F81-A221-1C115CAADDAD}" = QuickTime
"{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}" = SigmaTel Audio
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}" = Apple Mobile Device Support
"{AB708C9B-97C8-4AC9-899B-DBF226AC9382}" = Roxio RecordNow Audio
"{AC76BA86-7AD7-1033-7B44-A71000000002}" = Adobe Reader 7.1.0
"{AFEB71C8-5A1F-4D3B-FD57-5E08166FE2EE}" = Skins
"{B12665F4-4E93-4AB4-B7FC-37053B524629}" = Roxio RecordNow Copy
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B48DBEEB-9EEF-9F27-E1D8-339340FC7178}" = Catalyst Control Center Localization Korean
"{B9F49E54-FEF1-1940-CA96-73DADDFEF2A2}" = CCC Help Chinese Standard
"{BAFCD194-FBC5-EA66-02E3-A44EBFAB7E27}" = CCC Help Italian
"{C084FA87-793F-9590-C96B-9DE325C5FA6E}" = CCC Help Korean
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C151CE54-E7EA-4804-854B-F515368B0798}" = AMD Processor Driver
"{C29B157B-96F6-AEBC-B2A4-001ABB08B1D1}" = CCC Help Portuguese
"{C346B1F7-277F-8C0E-8961-56E6D543AA54}" = CCC Help Japanese
"{C4124E95-5061-4776-8D5D-E3D931C778E1}" = Microsoft VC9 runtime libraries
"{C4E60A38-F0C1-AD6B-E130-CE214C98BD4B}" = CCC Help Spanish
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D08C5590-7875-0E44-65EE-EE1D9C4A6FB1}" = CCC Help German
"{D5CF17D4-A616-0853-4EE8-50852BE6CA01}" = ccc-core-static
"{DE8AC8C4-D7D2-D6A7-B28B-9043DD65AA09}" = Catalyst Control Center Localization Chinese Traditional
"{DF62D775-BB7C-4AFA-9CA4-DDA1C4855F28}" = Dell Mobile Broadband Card Utility
"{EC2A8F27-4FBF-4E41-B27B-FE822511B761}" = iTunes
"{F4CF6586-4426-793B-1E7E-5871A85EDE78}" = Catalyst Control Center Core Implementation
"{F868ADD5-65FC-97FB-D083-096292FA6E2F}" = CCC Help Chinese Traditional
"{F88F9DF7-042F-80D3-8883-19A8BF2A9DC7}" = Catalyst Control Center Localization French
"{FE055AD6-C23A-B1B8-C0E6-A45C177E2E03}" = Catalyst Control Center Localization Portuguese
"4569969E1360D2854474C661EF9B4D54F143EB16" = Windows Driver Package - Ricoh Company (rimsptsk) hdc (11/14/2006 6.00.01.04)
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"AIM_6" = AIM 6
"All ATI Software" = ATI - Software Uninstall Utility
"ATI Display Driver" = ATI Display Driver
"Broadcom 802.11b Network Adapter" = Dell Wireless WLAN Card
"CCleaner" = CCleaner (remove only)
"CNXT_MODEM_HDAUDIO_VEN_14F1&DEV;_2BFA&SUBSYS;_14F100C3" = Conexant HDA D110 MDC V.92 Modem
"ENTERPRISER" = Microsoft Office Enterprise 2007
"FrostWire" = FrostWire 4.18.1
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.5.18)" = Mozilla Firefox (3.5.18)
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"Spyware Doctor" = Spyware Doctor with AntiVirus 8.0
"SpywareBlaster_is1" = SpywareBlaster 4.4
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"ViewpointMediaPlayer" = Viewpoint Media Player
"Webroot Software" = Webroot Software
"Windows XP Service Pack" = Windows XP Service Pack 3
"Yahoo! Companion" = Yahoo! Toolbar
"Yahoo! Messenger" = Yahoo! Messenger
"Yahoo! Software Update" = Yahoo! Software Update

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Move Media Player" = Move Media Player
"Yahoo! BrowserPlus" = Yahoo! BrowserPlus

========== Last 10 Event Log Errors ==========

Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!

< End of report >

Thanks for your help!

mowman

Post #5April 18, 2011, 9:50 AM UTC

Please do the following,run Iexplore again first if you need to.

Run OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:Services

:Otl
O4 - HKCU..\Run: [HDFryVTMFjAtTWN] C:\Documents and Settings\All Users\Application Data\HDFryVTMFjAtTWN.exe (WinSCP)
O33 - MountPoints2\{be095d3f-9104-11de-9199-0019b98268b2}\Shell - "" = AutoRun
O33 - MountPoints2\{be095d3f-9104-11de-9199-0019b98268b2}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{be095d3f-9104-11de-9199-0019b98268b2}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a
[2011/04/12 01:31:45 | 000,000,000 | -H-D | C] – C:\Documents and Settings\Ryan B\Start Menu\Programs\Windows Restore
[2011/04/12 01:16:49 | 000,557,056 | -H– | C] (WinSCP) – C:\Documents and Settings\All Users\Application Data\HDFryVTMFjAtTWN.exe
[6 C:\Documents and Settings\Ryan B\My Documents\*.tmp files -> C:\Documents and Settings\Ryan B\My Documents\*.tmp -> ]
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[13 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2011/04/17 17:36:30 | 000,000,336 | -H– | M] () – C:\Documents and Settings\All Users\Application Data\19783476
[2011/04/17 17:04:57 | 000,479,232 | -H– | M] () – C:\Documents and Settings\All Users\Application Data\19783476.exe


:Commands
[emptytemp]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
See this Link for programs that need to be disabled and instruction on how to disable them.
Remember to re-enable them when we're done.
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

*If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.

ksc89

Post #6April 18, 2011, 4:19 PM UTC

This is the log after I ran the run fix on otl…

All processes killed
========== SERVICES/DRIVERS ==========
========== OTL ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\HDFryVTMFjAtTWN deleted successfully.
File C:\Documents and Settings\All Users\Application Data\HDFryVTMFjAtTWN.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{be095d3f-9104-11de-9199-0019b98268b2}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{be095d3f-9104-11de-9199-0019b98268b2}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{be095d3f-9104-11de-9199-0019b98268b2}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{be095d3f-9104-11de-9199-0019b98268b2}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{be095d3f-9104-11de-9199-0019b98268b2}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{be095d3f-9104-11de-9199-0019b98268b2}\ not found.
File F:\LaunchU3.exe -a not found.
Folder C:\Documents and Settings\Ryan B\Start Menu\Programs\Windows Restore\ not found.
File C:\Documents and Settings\All Users\Application Data\HDFryVTMFjAtTWN.exe not found.
File/Folder C:\Documents and Settings\Ryan B\My Documents\*.tmp not found.
File/Folder C:\WINDOWS\System32\*.tmp not found.
File/Folder C:\WINDOWS\*.tmp not found.
File C:\Documents and Settings\All Users\Application Data\19783476 not found.
File C:\Documents and Settings\All Users\Application Data\19783476.exe not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 0 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Ryan B
->Temp folder emptied: 55493125 bytes
->Temporary Internet Files folder emptied: 4115364 bytes
->Java cache emptied: 81119912 bytes
->FireFox cache emptied: 46003755 bytes
->Flash cache emptied: 2953991 bytes

User: Visitor
->Temp folder emptied: 2220 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->FireFox cache emptied: 40351328 bytes
->Flash cache emptied: 2225 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 38224 bytes
Windows Temp folder emptied: 98759656 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 68951944 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 480499 bytes
RecycleBin emptied: 27513998 bytes

Total Files Cleaned = 406.00 mb

OTL by OldTimer - Version 3.2.22.3 log created on 04182011_115007

Files\Folders moved on Reboot…
C:\Documents and Settings\Ryan B\Local Settings\Temp\~DFABB4.tmp moved successfully.
C:\Documents and Settings\Ryan B\Local Settings\Temporary Internet Files\Content.IE5\QCNP5XWC\ads[1].htm moved successfully.
C:\Documents and Settings\Ryan B\Local Settings\Temporary Internet Files\Content.IE5\QCNP5XWC\ads[2].htm moved successfully.
C:\Documents and Settings\Ryan B\Local Settings\Temporary Internet Files\Content.IE5\QCNP5XWC\iframescript[1].htm moved successfully.
C:\Documents and Settings\Ryan B\Local Settings\Temporary Internet Files\Content.IE5\QCNP5XWC\like[1].htm moved successfully.
File\Folder C:\Documents and Settings\Ryan B\Local Settings\Temporary Internet Files\Content.IE5\FOQ6WSSI\error[4] not found!
C:\Documents and Settings\Ryan B\Local Settings\Temporary Internet Files\Content.IE5\EXDEI51Y\iframe[1].htm moved successfully.
C:\Documents and Settings\Ryan B\Local Settings\Temporary Internet Files\Content.IE5\DZBTBQON\index[1].htm moved successfully.
C:\Documents and Settings\Ryan B\Local Settings\Temporary Internet Files\Content.IE5\9NORNPAS\ads[4].htm moved successfully.
C:\Documents and Settings\Ryan B\Local Settings\Temporary Internet Files\AntiPhishing\A0AB7674-8D67-4F4D-B5E1-96FAEADFB79D.dat moved successfully.
File\Folder C:\Documents and Settings\Ryan B\Local Settings\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\Cache.Trash\Trash\Cache\00A294CAd01 not found!
File\Folder C:\Documents and Settings\Ryan B\Application Data\Macromedia\Flash Player\#SharedObjects\MAYYNC7D\www.gaytube.com\analytics.sol not found!
File\Folder C:\Documents and Settings\Ryan B\Application Data\Macromedia\Flash Player\#SharedObjects\MAYYNC7D\www.gaytube.com\com.jeroenwijering.sol not found!

Registry entries deleted on Reboot…

Here is my new OTL LOG…..

OTL logfile created on: 4/17/2011 6:48:59 PM - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Ryan B\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

894.00 Mb Total Physical Memory | 224.00 Mb Available Physical Memory | 25.00% Memory free
2.00 Gb Paging File | 1.00 Gb Available in Paging File | 61.00% Paging File free
Paging file location(s): C:\pagefile.sys 1344 2688 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 111.70 Gb Total Space | 83.42 Gb Free Space | 74.68% Space Free | Partition Type: NTFS

Computer Name: RYAN | User Name: Ryan B | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Ryan B\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Webroot\Security\Current\Framework\WRConsumerService.exe (Webroot Software, Inc. )
PRC - C:\Program Files\Webroot\Security\Current\Framework\WRTray.exe (Webroot Software, Inc. )
PRC - C:\Program Files\Webroot\Security\Current\plugins\antimalware\AEI.exe (Webroot Software, Inc. (www.webroot.com))
PRC - C:\Program Files\Spyware Doctor\pctsGui.exe (PC Tools)
PRC - C:\Program Files\Spyware Doctor\pctsSvc.exe (PC Tools)
PRC - C:\Program Files\Spyware Doctor\pctsAuxs.exe (PC Tools)
PRC - C:\Program Files\AIM6\aim6.exe (AOL LLC)
PRC - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited)
PRC - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
PRC - C:\Program Files\AIM6\aolsoftware.exe (AOL LLC)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\SigmaTel\C-Major Audio\DellXPM_5515v131\WDM\stacsv.exe (SigmaTel, Inc.)
PRC - C:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exe (SigmaTel, Inc.)
PRC - C:\Program Files\Viewpoint\Common\ViewpointService.exe (Viewpoint Corporation)
PRC - C:\WINDOWS\system32\DLA\DLACTRLW.EXE (Sonic Solutions)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Ryan B\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)
MOD - C:\Program Files\Spyware Doctor\PCTGMhk.dll (PC Tools)

========== Win32 Services (SafeList) ==========

SRV - (HidServ) – File not found
SRV - (WRConsumerService) – C:\Program Files\Webroot\Security\Current\Framework\WRConsumerService.exe (Webroot Software, Inc. )
SRV - (WebrootSpySweeperService) – C:\Program Files\Webroot\Security\current\plugins\antimalware\AEI.exe (Webroot Software, Inc. (www.webroot.com))
SRV - (sdCoreService) – C:\Program Files\Spyware Doctor\pctsSvc.exe (PC Tools)
SRV - (SpyHunter 4 Service) – C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe (Enigma Software Group USA, LLC.)
SRV - (sdAuxService) – C:\Program Files\Spyware Doctor\pctsAuxs.exe (PC Tools)
SRV - (YahooAUService) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
SRV - (STacSV) – C:\Program Files\SigmaTel\C-Major Audio\DellXPM_5515v131\WDM\stacsv.exe (SigmaTel, Inc.)
SRV - (Viewpoint Manager Service) – C:\Program Files\Viewpoint\Common\ViewpointService.exe (Viewpoint Corporation)

========== Driver Services (SafeList) ==========

DRV - (PCTCore) – C:\WINDOWS\system32\drivers\PCTCore.sys (PC Tools)
DRV - (SSIDRV) – C:\WINDOWS\SYSTEM32\Drivers\SSIDRV.SYS (Webroot Software, Inc. (www.webroot.com))
DRV - (SSFMONM) – C:\WINDOWS\system32\drivers\ssfmonm.sys (Webroot Software, Inc. (www.webroot.com))
DRV - (SSHRMD) – C:\WINDOWS\SYSTEM32\Drivers\SSHRMD.SYS (Webroot Software, Inc. (www.webroot.com))
DRV - (pctEFA) – C:\WINDOWS\system32\drivers\pctEFA.sys (PC Tools)
DRV - (pctDS) – C:\WINDOWS\system32\drivers\pctDS.sys (PC Tools)
DRV - (esgiguard) – C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys ()
DRV - (NwlnkIpx) – C:\WINDOWS\system32\drivers\nwlnkipx.sys (Microsoft Corporation)
DRV - (STHDA) – C:\WINDOWS\system32\drivers\sthda.sys (SigmaTel, Inc.)
DRV - (BCM43XX) – C:\WINDOWS\system32\drivers\BCMWL5.SYS (Broadcom Corporation)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (bcm4sbxp) – C:\WINDOWS\system32\drivers\bcm4sbxp.sys (Broadcom Corporation)
DRV - (rimmptsk) – C:\WINDOWS\system32\drivers\rimmptsk.sys (REDC)
DRV - (AmdK8) – C:\WINDOWS\system32\drivers\AmdK8.sys (Advanced Micro Devices)
DRV - (PCASp50) – C:\WINDOWS\system32\drivers\PCASp50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (NWADI) – C:\WINDOWS\system32\drivers\NWADIenum.sys (Novatel Wireless Inc)
DRV - (DLAUDFAM) – C:\WINDOWS\system32\DLA\DLAUDFAM.SYS (Sonic Solutions)
DRV - (DLAUDF_M) – C:\WINDOWS\system32\DLA\DLAUDF_M.SYS (Sonic Solutions)
DRV - (DLAIFS_M) – C:\WINDOWS\system32\DLA\DLAIFS_M.SYS (Sonic Solutions)
DRV - (DLABOIOM) – C:\WINDOWS\system32\DLA\DLABOIOM.SYS (Sonic Solutions)
DRV - (DLAOPIOM) – C:\WINDOWS\system32\DLA\DLAOPIOM.SYS (Sonic Solutions)
DRV - (DLAPoolM) – C:\WINDOWS\system32\DLA\DLAPoolM.SYS (Sonic Solutions)
DRV - (DLADResN) – C:\WINDOWS\system32\DLA\DLADResN.SYS (Sonic Solutions)
DRV - (DLACDBHM) – C:\WINDOWS\system32\drivers\DLACDBHM.SYS (Sonic Solutions)
DRV - (DLARTL_N) – C:\WINDOWS\system32\drivers\DLARTL_N.SYS (Sonic Solutions)
DRV - (NwlnkNb) – C:\WINDOWS\system32\drivers\nwlnknb.sys (Microsoft Corporation)
DRV - (NwlnkSpx) – C:\WINDOWS\system32\drivers\nwlnkspx.sys (Microsoft Corporation)
DRV - (ADM8511) – C:\WINDOWS\system32\drivers\ADM8511.SYS (ADMtek Incorporated)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\..\URLSearchHook: {472734EA-242A-422b-ADF8-83D1E48CC825} - Reg Error: Key error. File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

FF - HKLM\software\mozilla\Mozilla Firefox 3.5.18\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/03/27 14:29:55 | 000,000,000 | -H-D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.18\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/03/23 14:24:54 | 000,000,000 | -H-D | M]

[2009/10/26 14:16:37 | 000,000,000 | -H-D | M] (No name found) – C:\Documents and Settings\Ryan B\Application Data\Mozilla\Extensions
[2011/04/17 18:47:54 | 000,000,000 | -H-D | M] (No name found) – C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\extensions
[2009/12/02 22:23:30 | 000,000,000 | -H-D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/04/17 18:48:04 | 000,000,000 | —D | M] (Support.com Toolbar) – C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\extensions\[removed]
[2011/04/17 12:15:35 | 000,000,000 | -H-D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2010/01/23 19:10:11 | 000,000,000 | -H-D | M] (Move Media Player) – C:\DOCUMENTS AND SETTINGS\RYAN B\APPLICATION DATA\MOVE NETWORKS
[2009/09/12 22:08:29 | 000,000,000 | -H-D | M] (Java Quick Starter) – C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2007/04/16 13:07:12 | 000,180,293 | -H– | M] () – C:\Program Files\Mozilla Firefox\plugins\npViewpoint.dll

O1 HOSTS File: ([2011/04/08 13:48:33 | 000,000,027 | -H– | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (&Yahoo;! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\DLA\DLASHX_W.DLL (Sonic Solutions)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE (Sonic Solutions)
O4 - HKLM..\Run: [ISTray] C:\Program Files\Spyware Doctor\pctsGui.exe (PC Tools)
O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exe (SigmaTel, Inc.)
O4 - HKLM..\Run: [SpyHunter Security Suite] C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter4.exe (Enigma Software Group USA, LLC.)
O4 - HKLM..\Run: [WebrootTrayApp] C:\Program Files\Webroot\Security\Current\Framework\WRTray.exe (Webroot Software, Inc. )
O4 - HKCU..\Run: [Aim6] C:\Program Files\AIM6\aim6.exe (AOL LLC)
O4 - HKCU..\Run: [HDFryVTMFjAtTWN] C:\Documents and Settings\All Users\Application Data\HDFryVTMFjAtTWN.exe (WinSCP)
O4 - HKCU..\Run: [Messenger (Yahoo!)] C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited)
O4 - HKCU..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe ()
O4 - HKLM..\RunOnce: [InnoSetupRegFile.0000000001] C:\WINDOWS\is-2H2SU.exe ()
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware (registration)] C:\Program Files\Malwarebytes' Anti-Malware\mbamext.dll (Malwarebytes Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000026 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_15)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\Ryan B\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Ryan B\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O30 - LSA: Authentication Packages - (nwprovau) - C:\WINDOWS\System32\nwprovau.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/08/19 20:33:20 | 000,000,000 | -H– | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O33 - MountPoints2\{be095d3f-9104-11de-9199-0019b98268b2}\Shell - "" = AutoRun
O33 - MountPoints2\{be095d3f-9104-11de-9199-0019b98268b2}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{be095d3f-9104-11de-9199-0019b98268b2}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: HidServ - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax ()
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll ()

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (58560405907177472)

========== Files/Folders - Created Within 30 Days ==========

[2011/04/17 18:47:54 | 000,000,000 | —D | C] – C:\Program Files\Ask.com
[2011/04/17 18:46:50 | 005,689,312 | —- | C] (Support.com ) – C:\Documents and Settings\Ryan B\Desktop\ARO2011_tbt.exe
[2011/04/17 18:45:01 | 000,020,952 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2011/04/17 18:39:54 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Ryan B\Recent
[2011/04/17 16:45:02 | 000,580,608 | -H– | C] (OldTimer Tools) – C:\Documents and Settings\Ryan B\Desktop\OTL.exe
[2011/04/17 16:40:39 | 007,734,240 | -H– | C] (Malwarebytes Corporation ) – C:\Documents and Settings\Ryan B\Desktop\mbam-setup.exe
[2011/04/12 23:41:35 | 000,000,000 | -H-D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Spybot - Search & Destroy
[2011/04/12 23:41:27 | 000,000,000 | -H-D | C] – C:\Program Files\Spybot - Search & Destroy
[2011/04/12 23:41:27 | 000,000,000 | -H-D | C] – C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
[2011/04/12 22:26:14 | 000,000,000 | -H-D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\GridinSoft
[2011/04/12 22:25:50 | 000,000,000 | -H-D | C] – C:\Program Files\GridinSoft Trojan Killer
[2011/04/12 14:01:55 | 000,000,000 | -H-D | C] – C:\32788R22FWJFW
[2011/04/12 13:18:06 | 000,656,320 | -H– | C] (PC Tools) – C:\WINDOWS\System32\drivers\pctEFA.sys
[2011/04/12 13:18:06 | 000,338,880 | -H– | C] (PC Tools) – C:\WINDOWS\System32\drivers\pctDS.sys
[2011/04/12 13:17:53 | 000,000,000 | -H-D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\PC Tools Security
[2011/04/12 12:46:48 | 000,000,000 | -HSD | C] – C:\WINDOWS\CSC
[2011/04/12 12:40:35 | 000,000,000 | -H-D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\SpywareBlaster
[2011/04/12 12:40:33 | 000,000,000 | -H-D | C] – C:\Program Files\SpywareBlaster
[2011/04/12 01:53:31 | 000,000,000 | -H-D | C] – C:\Documents and Settings\Ryan B\Start Menu\Programs\SpyHunter
[2011/04/12 01:53:27 | 000,000,000 | -H-D | C] – C:\sh4ldr
[2011/04/12 01:53:27 | 000,000,000 | -H-D | C] – C:\Program Files\Enigma Software Group
[2011/04/12 01:53:01 | 000,000,000 | -H-D | C] – C:\Program Files\Common Files\Wise Installation Wizard
[2011/04/12 01:31:45 | 000,000,000 | -H-D | C] – C:\Documents and Settings\Ryan B\Start Menu\Programs\Windows Restore
[2011/04/12 01:16:49 | 000,557,056 | -H– | C] (WinSCP) – C:\Documents and Settings\All Users\Application Data\HDFryVTMFjAtTWN.exe
[6 C:\Documents and Settings\Ryan B\My Documents\*.tmp files -> C:\Documents and Settings\Ryan B\My Documents\*.tmp -> ]
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[13 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/04/17 18:48:02 | 000,000,236 | —- | M] () – C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2011/04/17 18:46:50 | 005,689,312 | —- | M] (Support.com ) – C:\Documents and Settings\Ryan B\Desktop\ARO2011_tbt.exe
[2011/04/17 18:45:17 | 000,709,456 | —- | M] () – C:\WINDOWS\is-2H2SU.exe
[2011/04/17 18:45:17 | 000,010,562 | —- | M] () – C:\WINDOWS\is-2H2SU.msg
[2011/04/17 18:45:17 | 000,000,415 | —- | M] () – C:\WINDOWS\is-2H2SU.lst
[2011/04/17 18:31:08 | 000,000,886 | -H– | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/04/17 18:23:24 | 000,002,206 | -H– | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/04/17 18:23:12 | 000,000,882 | -H– | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/04/17 18:22:01 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/04/17 17:36:30 | 000,000,336 | -H– | M] () – C:\Documents and Settings\All Users\Application Data\19783476
[2011/04/17 17:04:57 | 000,479,232 | -H– | M] () – C:\Documents and Settings\All Users\Application Data\19783476.exe
[2011/04/17 16:45:05 | 000,580,608 | -H– | M] (OldTimer Tools) – C:\Documents and Settings\Ryan B\Desktop\OTL.exe
[2011/04/17 16:40:39 | 007,734,240 | -H– | M] (Malwarebytes Corporation ) – C:\Documents and Settings\Ryan B\Desktop\mbam-setup.exe
[2011/04/17 16:35:06 | 001,006,778 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\new1.exe
[2011/04/17 16:35:06 | 001,006,778 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\new.exe
[2011/04/15 18:30:59 | 000,000,336 | -H– | M] () – C:\Documents and Settings\All Users\Application Data\18407220
[2011/04/13 09:15:24 | 000,000,096 | -H– | M] () – C:\Documents and Settings\All Users\Application Data\~19455796
[2011/04/13 09:15:23 | 000,000,128 | -H– | M] () – C:\Documents and Settings\All Users\Application Data\~19455796r
[2011/04/13 07:55:56 | 000,000,811 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\Windows Restore.lnk
[2011/04/13 07:55:52 | 000,000,336 | -H– | M] () – C:\Documents and Settings\All Users\Application Data\19455796
[2011/04/12 23:41:35 | 000,000,951 | -H– | M] () – C:\Documents and Settings\Ryan B\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2011/04/12 23:41:35 | 000,000,933 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\Spybot - Search & Destroy.lnk
[2011/04/12 23:12:45 | 000,000,832 | -H– | M] () – C:\Documents and Settings\Ryan B\Application Data\Microsoft\Internet Explorer\Quick Launch\Trojan Killer.lnk
[2011/04/12 23:12:45 | 000,000,814 | -H– | M] () – C:\Documents and Settings\All Users\Desktop\Trojan Killer.lnk
[2011/04/12 13:18:28 | 000,658,488 | -H– | M] () – C:\WINDOWS\System32\drivers\Cat.DB
[2011/04/12 13:17:54 | 000,001,637 | -H– | M] () – C:\Documents and Settings\All Users\Desktop\Spyware Doctor.lnk
[2011/04/12 13:14:50 | 000,512,992 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\sdasetup_revwire207.exe
[2011/04/12 12:40:35 | 000,000,690 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\SpywareBlaster.lnk
[2011/04/12 01:53:32 | 000,001,975 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\SpyHunter.lnk
[2011/04/12 01:16:49 | 000,557,056 | -H– | M] (WinSCP) – C:\Documents and Settings\All Users\Application Data\HDFryVTMFjAtTWN.exe
[2011/04/12 00:51:16 | 000,046,471 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\myc.jpg
[2011/04/11 16:08:47 | 000,435,828 | -H– | M] () – C:\WINDOWS\System32\perfh009.dat
[2011/04/11 16:08:47 | 000,068,558 | -H– | M] () – C:\WINDOWS\System32\perfc009.dat
[2011/03/28 22:26:50 | 005,084,128 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\03-young-modern-life.mp3
[2011/03/25 19:07:05 | 000,027,356 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\schoolpicture.jpg
[2011/03/23 14:39:59 | 000,030,756 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\after gym.jpg
[2011/03/21 23:33:04 | 000,021,652 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\me4.jpg
[2011/03/20 11:12:29 | 003,128,890 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\2011 Returning Info Form_distributed.pdf
[6 C:\Documents and Settings\Ryan B\My Documents\*.tmp files -> C:\Documents and Settings\Ryan B\My Documents\*.tmp -> ]
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[13 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/04/17 18:48:01 | 000,000,236 | —- | C] () – C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2011/04/17 18:45:17 | 000,709,456 | —- | C] () – C:\WINDOWS\is-2H2SU.exe
[2011/04/17 18:45:17 | 000,010,562 | —- | C] () – C:\WINDOWS\is-2H2SU.msg
[2011/04/17 18:45:17 | 000,000,415 | —- | C] () – C:\WINDOWS\is-2H2SU.lst
[2011/04/17 18:34:56 | 001,006,778 | -H– | C] () – C:\Documents and Settings\Ryan B\Desktop\new1.exe
[2011/04/17 17:36:30 | 000,000,336 | -H– | C] () – C:\Documents and Settings\All Users\Application Data\19783476
[2011/04/17 17:04:57 | 000,479,232 | -H– | C] () – C:\Documents and Settings\All Users\Application Data\19783476.exe
[2011/04/17 16:35:02 | 001,006,778 | -H– | C] () – C:\Documents and Settings\Ryan B\Desktop\new.exe
[2011/04/15 18:30:59 | 000,000,336 | -H– | C] () – C:\Documents and Settings\All Users\Application Data\18407220
[2011/04/13 09:15:23 | 000,000,128 | -H– | C] () – C:\Documents and Settings\All Users\Application Data\~19455796r
[2011/04/13 09:15:23 | 000,000,096 | -H– | C] () – C:\Documents and Settings\All Users\Application Data\~19455796
[2011/04/13 07:55:56 | 000,000,811 | -H– | C] () – C:\Documents and Settings\Ryan B\Desktop\Windows Restore.lnk
[2011/04/13 07:55:52 | 000,000,336 | -H– | C] () – C:\Documents and Settings\All Users\Application Data\19455796
[2011/04/12 23:41:35 | 000,000,951 | -H– | C] () – C:\Documents and Settings\Ryan B\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2011/04/12 23:41:35 | 000,000,933 | -H– | C] () – C:\Documents and Settings\Ryan B\Desktop\Spybot - Search & Destroy.lnk
[2011/04/12 23:12:45 | 000,000,832 | -H– | C] () – C:\Documents and Settings\Ryan B\Application Data\Microsoft\Internet Explorer\Quick Launch\Trojan Killer.lnk
[2011/04/12 22:26:19 | 000,000,814 | -H– | C] () – C:\Documents and Settings\All Users\Desktop\Trojan Killer.lnk
[2011/04/12 13:18:12 | 000,658,488 | -H– | C] () – C:\WINDOWS\System32\drivers\Cat.DB
[2011/04/12 13:17:54 | 000,001,637 | -H– | C] () – C:\Documents and Settings\All Users\Desktop\Spyware Doctor.lnk
[2011/04/12 13:14:59 | 000,512,992 | -H– | C] () – C:\Documents and Settings\Ryan B\Desktop\sdasetup_revwire207.exe
[2011/04/12 12:40:35 | 000,000,690 | -H– | C] () – C:\Documents and Settings\Ryan B\Desktop\SpywareBlaster.lnk
[2011/04/12 01:53:32 | 000,001,975 | -H– | C] () – C:\Documents and Settings\Ryan B\Desktop\SpyHunter.lnk
[2011/04/12 00:51:15 | 000,046,471 | -H– | C] () – C:\Documents and Settings\Ryan B\Desktop\myc.jpg
[2011/03/28 21:51:16 | 005,084,128 | -H– | C] () – C:\Documents and Settings\Ryan B\Desktop\03-young-modern-life.mp3
[2011/03/25 19:07:03 | 000,027,356 | -H– | C] () – C:\Documents and Settings\Ryan B\Desktop\schoolpicture.jpg
[2011/03/23 14:39:58 | 000,030,756 | -H– | C] () – C:\Documents and Settings\Ryan B\Desktop\after gym.jpg
[2011/03/21 23:33:03 | 000,021,652 | -H– | C] () – C:\Documents and Settings\Ryan B\Desktop\me4.jpg
[2011/03/20 11:12:28 | 003,128,890 | -H– | C] () – C:\Documents and Settings\Ryan B\Desktop\2011 Returning Info Form_distributed.pdf
[2010/10/02 12:55:56 | 000,030,424 | -H– | C] () – C:\WINDOWS\System32\wrLZMA.dll
[2010/10/02 12:55:56 | 000,017,472 | -H– | C] () – C:\WINDOWS\System32\SsiEfr.exe
[2010/03/02 01:35:11 | 000,006,144 | -H– | C] () – C:\Documents and Settings\Ryan B\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/12/12 15:11:10 | 000,261,632 | -H– | C] () – C:\WINDOWS\PEV.exe
[2009/12/12 15:11:10 | 000,098,816 | -H– | C] () – C:\WINDOWS\sed.exe
[2009/12/12 15:11:10 | 000,080,412 | -H– | C] () – C:\WINDOWS\grep.exe
[2009/12/12 15:11:10 | 000,077,312 | -H– | C] () – C:\WINDOWS\MBR.exe
[2009/12/12 15:11:10 | 000,068,096 | -H– | C] () – C:\WINDOWS\zip.exe
[2009/09/18 20:13:37 | 000,000,664 | -H– | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2009/08/24 19:36:03 | 000,000,000 | -H– | C] () – C:\WINDOWS\nsreg.dat
[2009/08/24 17:44:11 | 000,086,016 | -H– | C] () – C:\WINDOWS\System32\preflib.dll
[2009/08/24 17:44:09 | 000,020,480 | -H– | C] () – C:\WINDOWS\System32\WLTRYSVC.EXE
[2009/08/24 17:44:08 | 000,757,760 | -H– | C] () – C:\WINDOWS\System32\bcm1xsup.dll
[2009/08/24 16:22:09 | 003,107,788 | -H– | C] () – C:\WINDOWS\System32\ativvaxx.dat
[2009/08/24 16:22:09 | 000,147,685 | -H– | C] () – C:\WINDOWS\System32\atiicdxx.dat
[2009/08/19 21:30:17 | 000,000,174 | -H– | C] () – C:\WINDOWS\wininit.ini
[2009/08/19 20:36:41 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2009/08/19 20:29:30 | 000,021,640 | -H– | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2009/08/19 16:15:27 | 000,004,161 | -H– | C] () – C:\WINDOWS\ODBCINST.INI
[2009/08/19 16:07:20 | 000,267,800 | -H– | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2005/11/18 14:47:26 | 000,000,000 | -H– | C] () – C:\WINDOWS\System32\px.ini
[2005/03/21 19:48:05 | 013,107,200 | -H– | C] () – C:\WINDOWS\System32\oembios.bin
[2005/03/21 19:48:05 | 000,004,627 | -H– | C] () – C:\WINDOWS\System32\oembios.dat
[2004/08/04 06:00:00 | 000,755,200 | -H– | C] () – C:\WINDOWS\System32\ir50_32.dll
[2004/08/04 06:00:00 | 000,673,088 | -H– | C] () – C:\WINDOWS\System32\mlang.dat
[2004/08/04 06:00:00 | 000,435,828 | -H– | C] () – C:\WINDOWS\System32\perfh009.dat
[2004/08/04 06:00:00 | 000,338,432 | -H– | C] () – C:\WINDOWS\System32\ir41_qcx.dll
[2004/08/04 06:00:00 | 000,272,128 | -H– | C] () – C:\WINDOWS\System32\perfi009.dat
[2004/08/04 06:00:00 | 000,218,003 | -H– | C] () – C:\WINDOWS\System32\dssec.dat
[2004/08/04 06:00:00 | 000,200,192 | -H– | C] () – C:\WINDOWS\System32\ir50_qc.dll
[2004/08/04 06:00:00 | 000,183,808 | -H– | C] () – C:\WINDOWS\System32\ir50_qcx.dll
[2004/08/04 06:00:00 | 000,120,320 | -H– | C] () – C:\WINDOWS\System32\ir41_qc.dll
[2004/08/04 06:00:00 | 000,068,558 | -H– | C] () – C:\WINDOWS\System32\perfc009.dat
[2004/08/04 06:00:00 | 000,046,258 | -H– | C] () – C:\WINDOWS\System32\mib.bin
[2004/08/04 06:00:00 | 000,028,626 | -H– | C] () – C:\WINDOWS\System32\perfd009.dat
[2004/08/04 06:00:00 | 000,004,569 | -H– | C] () – C:\WINDOWS\System32\secupd.dat
[2004/08/04 06:00:00 | 000,001,804 | -H– | C] () – C:\WINDOWS\System32\dcache.bin
[2004/08/04 06:00:00 | 000,000,741 | -H– | C] () – C:\WINDOWS\System32\noise.dat

========== LOP Check ==========

[2009/08/24 23:11:17 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\acccore
[2011/01/27 23:22:05 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\Novatel Wireless
[2011/04/17 18:51:26 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2009/08/24 23:11:18 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\Viewpoint
[2010/10/02 12:53:03 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\{5D7316EC-0EDC-4C87-A589-9244C286BC92}
[2009/09/11 16:49:28 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/08/24 23:13:00 | 000,000,000 | -H-D | M] – C:\Documents and Settings\Ryan B\Application Data\acccore
[2011/04/08 02:51:10 | 000,000,000 | -H-D | M] – C:\Documents and Settings\Ryan B\Application Data\FrostWire
[2009/08/20 19:29:39 | 000,000,000 | -H-D | M] – C:\Documents and Settings\Ryan B\Application Data\Leadertech
[2009/10/07 16:05:49 | 000,000,000 | -H-D | M] – C:\Documents and Settings\Ryan B\Application Data\LimeWire
[2009/09/18 21:30:36 | 000,000,000 | -H-D | M] – C:\Documents and Settings\Ryan B\Application Data\Viewpoint
[2011/04/17 18:48:02 | 000,000,236 | —- | M] () – C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2009/08/19 20:33:20 | 000,000,000 | -H– | M] () – C:\AUTOEXEC.BAT
[2009/08/24 14:41:49 | 000,000,223 | -H– | M] () – C:\Boot.bak
[2009/12/12 15:12:25 | 000,000,293 | RHS- | M] () – C:\boot.ini
[2004/08/04 00:00:00 | 000,260,272 | -H– | M] () – C:\cmldr
[2010/03/10 02:31:14 | 000,039,395 | -H– | M] () – C:\ComboFix.txt
[2009/08/19 20:33:20 | 000,000,000 | -H– | M] () – C:\CONFIG.SYS
[2009/08/19 20:33:20 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2009/08/24 23:12:00 | 000,000,462 | -H– | M] () – C:\IPH.PH
[2009/08/19 20:33:20 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2004/08/04 06:00:00 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2009/08/24 13:56:08 | 000,250,048 | RHS- | M] () – C:\ntldr
[2011/04/17 18:21:42 | 1409,286,144 | -HS- | M] () – C:\pagefile.sys
[2011/04/17 18:41:27 | 000,000,564 | -H– | M] () – C:\rkill.log

< %systemroot%\Fonts\*.com >
[2006/04/18 15:39:28 | 000,026,040 | -H– | M] () – C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 14:53:56 | 000,026,489 | -H– | M] () – C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 15:39:28 | 000,029,779 | -H– | M] () – C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 14:58:52 | 000,030,808 | -H– | M] () – C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/08/19 20:32:48 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/07/06 08:06:10 | 000,089,088 | -H– | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2006/10/26 19:56:12 | 000,033,104 | -H– | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\msonpppr.dll
[2008/07/06 06:50:03 | 000,597,504 | -H– | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2009/08/19 16:06:13 | 000,094,208 | -H– | M] () – C:\WINDOWS\system32\config\default.sav
[2009/08/19 16:06:13 | 000,659,456 | -H– | M] () – C:\WINDOWS\system32\config\software.sav
[2009/08/19 16:06:13 | 000,901,120 | -H– | M] () – C:\WINDOWS\system32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2009/08/24 14:01:26 | 000,000,272 | -HS- | M] () – C:\Documents and Settings\All Users\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2009/08/24 14:26:44 | 000,000,119 | -HS- | M] () – C:\Documents and Settings\Ryan B\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2009/08/19 20:40:42 | 000,000,079 | -H– | M] () – C:\Documents and Settings\Ryan B\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >
[2010/03/10 02:22:31 | 003,885,183 | RH– | M] () – C:\Documents and Settings\Ryan B\Desktop\AB.exe.exe
[2011/04/17 18:46:50 | 005,689,312 | —- | M] (Support.com ) – C:\Documents and Settings\Ryan B\Desktop\ARO2011_tbt.exe
[2011/04/17 16:40:39 | 007,734,240 | -H– | M] (Malwarebytes Corporation ) – C:\Documents and Settings\Ryan B\Desktop\mbam-setup.exe
[2011/04/17 16:35:06 | 001,006,778 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\new.exe
[2011/04/17 16:35:06 | 001,006,778 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\new1.exe
[2011/04/17 16:45:05 | 000,580,608 | -H– | M] (OldTimer Tools) – C:\Documents and Settings\Ryan B\Desktop\OTL.exe
[2011/04/12 13:14:50 | 000,512,992 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\sdasetup_revwire207.exe
[2009/08/24 16:57:02 | 000,253,952 | -H– | M] (Phoenix Technologies, Ltd.) – C:\Documents and Settings\Ryan B\Desktop\WINPHLASH.EXE

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2009/08/24 14:26:44 | 000,000,122 | -HS- | M] () – C:\Documents and Settings\Ryan B\Favorites\Desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >
[2011/04/17 18:47:59 | 000,065,536 | -HS- | M] () – C:\Documents and Settings\Ryan B\Cookies\index.dat

< %SystemRoot%\system32\fonts\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-03-25 15:16:43

< >

========== Alternate Data Streams ==========

@Alternate Data Stream - 149 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2

< End of report >

I am unable to open combofix….I downloade dit to my desktop but it wont open….The bar shows up with the green showing its opening but doesnt end up opening.

ksc89

Post #7April 18, 2011, 4:47 PM UTC

When I try to run combofix it states that spyware doctor is prohibited the program to start….I cannot figure out how to disble this and my computer is still saying my program files are empty….There is not an icon in the tray to disable this program either.

mowman

Post #8April 18, 2011, 5:36 PM UTC last edited April 18, 2011, 5:51 PM UTC

Can you first go to add/remove programs and uninstall Spyware doctor.Do not use the internet apart from coming here until we can reinstall it later.

Next

Click start>run and copy/paste the following text into the run box and press enter

"%userprofile%\desktop\combofix.exe" /killall

Hopefully Combofix will now run,post the log if succesful.

Also re run OTL as the last log you posted was the original log.

ksc89

Post #9April 18, 2011, 7:35 PM UTC

I was able to run Combo Fix but after the scan it says please wait while a report is prepared….After that box went away a report did not show up…I ran it 3 times and still no report…..

I ran OTL again and the same log file came up I believe since the dates/times are identical….should I be putting anything into the custom part of the scan? the output is still at minimal and i did NOT check off LOP check or purity check…is there something I am doing wrong? here is the file that came up again after I ran the scan…

OTL logfile created on: 4/17/2011 6:48:59 PM - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Ryan B\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

894.00 Mb Total Physical Memory | 224.00 Mb Available Physical Memory | 25.00% Memory free
2.00 Gb Paging File | 1.00 Gb Available in Paging File | 61.00% Paging File free
Paging file location(s): C:\pagefile.sys 1344 2688 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 111.70 Gb Total Space | 83.42 Gb Free Space | 74.68% Space Free | Partition Type: NTFS

Computer Name: RYAN | User Name: Ryan B | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Ryan B\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Webroot\Security\Current\Framework\WRConsumerService.exe (Webroot Software, Inc. )
PRC - C:\Program Files\Webroot\Security\Current\Framework\WRTray.exe (Webroot Software, Inc. )
PRC - C:\Program Files\Webroot\Security\Current\plugins\antimalware\AEI.exe (Webroot Software, Inc. (www.webroot.com))
PRC - C:\Program Files\Spyware Doctor\pctsGui.exe (PC Tools)
PRC - C:\Program Files\Spyware Doctor\pctsSvc.exe (PC Tools)
PRC - C:\Program Files\Spyware Doctor\pctsAuxs.exe (PC Tools)
PRC - C:\Program Files\AIM6\aim6.exe (AOL LLC)
PRC - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited)
PRC - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
PRC - C:\Program Files\AIM6\aolsoftware.exe (AOL LLC)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\SigmaTel\C-Major Audio\DellXPM_5515v131\WDM\stacsv.exe (SigmaTel, Inc.)
PRC - C:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exe (SigmaTel, Inc.)
PRC - C:\Program Files\Viewpoint\Common\ViewpointService.exe (Viewpoint Corporation)
PRC - C:\WINDOWS\system32\DLA\DLACTRLW.EXE (Sonic Solutions)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Ryan B\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)
MOD - C:\Program Files\Spyware Doctor\PCTGMhk.dll (PC Tools)

========== Win32 Services (SafeList) ==========

SRV - (HidServ) – File not found
SRV - (WRConsumerService) – C:\Program Files\Webroot\Security\Current\Framework\WRConsumerService.exe (Webroot Software, Inc. )
SRV - (WebrootSpySweeperService) – C:\Program Files\Webroot\Security\current\plugins\antimalware\AEI.exe (Webroot Software, Inc. (www.webroot.com))
SRV - (sdCoreService) – C:\Program Files\Spyware Doctor\pctsSvc.exe (PC Tools)
SRV - (SpyHunter 4 Service) – C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe (Enigma Software Group USA, LLC.)
SRV - (sdAuxService) – C:\Program Files\Spyware Doctor\pctsAuxs.exe (PC Tools)
SRV - (YahooAUService) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
SRV - (STacSV) – C:\Program Files\SigmaTel\C-Major Audio\DellXPM_5515v131\WDM\stacsv.exe (SigmaTel, Inc.)
SRV - (Viewpoint Manager Service) – C:\Program Files\Viewpoint\Common\ViewpointService.exe (Viewpoint Corporation)

========== Driver Services (SafeList) ==========

DRV - (PCTCore) – C:\WINDOWS\system32\drivers\PCTCore.sys (PC Tools)
DRV - (SSIDRV) – C:\WINDOWS\SYSTEM32\Drivers\SSIDRV.SYS (Webroot Software, Inc. (www.webroot.com))
DRV - (SSFMONM) – C:\WINDOWS\system32\drivers\ssfmonm.sys (Webroot Software, Inc. (www.webroot.com))
DRV - (SSHRMD) – C:\WINDOWS\SYSTEM32\Drivers\SSHRMD.SYS (Webroot Software, Inc. (www.webroot.com))
DRV - (pctEFA) – C:\WINDOWS\system32\drivers\pctEFA.sys (PC Tools)
DRV - (pctDS) – C:\WINDOWS\system32\drivers\pctDS.sys (PC Tools)
DRV - (esgiguard) – C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys ()
DRV - (NwlnkIpx) – C:\WINDOWS\system32\drivers\nwlnkipx.sys (Microsoft Corporation)
DRV - (STHDA) – C:\WINDOWS\system32\drivers\sthda.sys (SigmaTel, Inc.)
DRV - (BCM43XX) – C:\WINDOWS\system32\drivers\BCMWL5.SYS (Broadcom Corporation)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (bcm4sbxp) – C:\WINDOWS\system32\drivers\bcm4sbxp.sys (Broadcom Corporation)
DRV - (rimmptsk) – C:\WINDOWS\system32\drivers\rimmptsk.sys (REDC)
DRV - (AmdK8) – C:\WINDOWS\system32\drivers\AmdK8.sys (Advanced Micro Devices)
DRV - (PCASp50) – C:\WINDOWS\system32\drivers\PCASp50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (NWADI) – C:\WINDOWS\system32\drivers\NWADIenum.sys (Novatel Wireless Inc)
DRV - (DLAUDFAM) – C:\WINDOWS\system32\DLA\DLAUDFAM.SYS (Sonic Solutions)
DRV - (DLAUDF_M) – C:\WINDOWS\system32\DLA\DLAUDF_M.SYS (Sonic Solutions)
DRV - (DLAIFS_M) – C:\WINDOWS\system32\DLA\DLAIFS_M.SYS (Sonic Solutions)
DRV - (DLABOIOM) – C:\WINDOWS\system32\DLA\DLABOIOM.SYS (Sonic Solutions)
DRV - (DLAOPIOM) – C:\WINDOWS\system32\DLA\DLAOPIOM.SYS (Sonic Solutions)
DRV - (DLAPoolM) – C:\WINDOWS\system32\DLA\DLAPoolM.SYS (Sonic Solutions)
DRV - (DLADResN) – C:\WINDOWS\system32\DLA\DLADResN.SYS (Sonic Solutions)
DRV - (DLACDBHM) – C:\WINDOWS\system32\drivers\DLACDBHM.SYS (Sonic Solutions)
DRV - (DLARTL_N) – C:\WINDOWS\system32\drivers\DLARTL_N.SYS (Sonic Solutions)
DRV - (NwlnkNb) – C:\WINDOWS\system32\drivers\nwlnknb.sys (Microsoft Corporation)
DRV - (NwlnkSpx) – C:\WINDOWS\system32\drivers\nwlnkspx.sys (Microsoft Corporation)
DRV - (ADM8511) – C:\WINDOWS\system32\drivers\ADM8511.SYS (ADMtek Incorporated)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\..\URLSearchHook: {472734EA-242A-422b-ADF8-83D1E48CC825} - Reg Error: Key error. File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

FF - HKLM\software\mozilla\Mozilla Firefox 3.5.18\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/03/27 14:29:55 | 000,000,000 | -H-D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.18\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/03/23 14:24:54 | 000,000,000 | -H-D | M]

[2009/10/26 14:16:37 | 000,000,000 | -H-D | M] (No name found) – C:\Documents and Settings\Ryan B\Application Data\Mozilla\Extensions
[2011/04/17 18:47:54 | 000,000,000 | -H-D | M] (No name found) – C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\extensions
[2009/12/02 22:23:30 | 000,000,000 | -H-D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/04/17 18:48:04 | 000,000,000 | —D | M] (Support.com Toolbar) – C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\extensions\[removed]
[2011/04/17 12:15:35 | 000,000,000 | -H-D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2010/01/23 19:10:11 | 000,000,000 | -H-D | M] (Move Media Player) – C:\DOCUMENTS AND SETTINGS\RYAN B\APPLICATION DATA\MOVE NETWORKS
[2009/09/12 22:08:29 | 000,000,000 | -H-D | M] (Java Quick Starter) – C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2007/04/16 13:07:12 | 000,180,293 | -H– | M] () – C:\Program Files\Mozilla Firefox\plugins\npViewpoint.dll

O1 HOSTS File: ([2011/04/08 13:48:33 | 000,000,027 | -H– | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (&Yahoo;! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\DLA\DLASHX_W.DLL (Sonic Solutions)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE (Sonic Solutions)
O4 - HKLM..\Run: [ISTray] C:\Program Files\Spyware Doctor\pctsGui.exe (PC Tools)
O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exe (SigmaTel, Inc.)
O4 - HKLM..\Run: [SpyHunter Security Suite] C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter4.exe (Enigma Software Group USA, LLC.)
O4 - HKLM..\Run: [WebrootTrayApp] C:\Program Files\Webroot\Security\Current\Framework\WRTray.exe (Webroot Software, Inc. )
O4 - HKCU..\Run: [Aim6] C:\Program Files\AIM6\aim6.exe (AOL LLC)
O4 - HKCU..\Run: [HDFryVTMFjAtTWN] C:\Documents and Settings\All Users\Application Data\HDFryVTMFjAtTWN.exe (WinSCP)
O4 - HKCU..\Run: [Messenger (Yahoo!)] C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited)
O4 - HKCU..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe ()
O4 - HKLM..\RunOnce: [InnoSetupRegFile.0000000001] C:\WINDOWS\is-2H2SU.exe ()
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware (registration)] C:\Program Files\Malwarebytes' Anti-Malware\mbamext.dll (Malwarebytes Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000026 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_15)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\Ryan B\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Ryan B\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O30 - LSA: Authentication Packages - (nwprovau) - C:\WINDOWS\System32\nwprovau.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/08/19 20:33:20 | 000,000,000 | -H– | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O33 - MountPoints2\{be095d3f-9104-11de-9199-0019b98268b2}\Shell - "" = AutoRun
O33 - MountPoints2\{be095d3f-9104-11de-9199-0019b98268b2}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{be095d3f-9104-11de-9199-0019b98268b2}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: HidServ - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax ()
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll ()

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (58560405907177472)

========== Files/Folders - Created Within 30 Days ==========

[2011/04/17 18:47:54 | 000,000,000 | —D | C] – C:\Program Files\Ask.com
[2011/04/17 18:46:50 | 005,689,312 | —- | C] (Support.com ) – C:\Documents and Settings\Ryan B\Desktop\ARO2011_tbt.exe
[2011/04/17 18:45:01 | 000,020,952 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2011/04/17 18:39:54 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Ryan B\Recent
[2011/04/17 16:45:02 | 000,580,608 | -H– | C] (OldTimer Tools) – C:\Documents and Settings\Ryan B\Desktop\OTL.exe
[2011/04/17 16:40:39 | 007,734,240 | -H– | C] (Malwarebytes Corporation ) – C:\Documents and Settings\Ryan B\Desktop\mbam-setup.exe
[2011/04/12 23:41:35 | 000,000,000 | -H-D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Spybot - Search & Destroy
[2011/04/12 23:41:27 | 000,000,000 | -H-D | C] – C:\Program Files\Spybot - Search & Destroy
[2011/04/12 23:41:27 | 000,000,000 | -H-D | C] – C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
[2011/04/12 22:26:14 | 000,000,000 | -H-D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\GridinSoft
[2011/04/12 22:25:50 | 000,000,000 | -H-D | C] – C:\Program Files\GridinSoft Trojan Killer
[2011/04/12 14:01:55 | 000,000,000 | -H-D | C] – C:\32788R22FWJFW
[2011/04/12 13:18:06 | 000,656,320 | -H– | C] (PC Tools) – C:\WINDOWS\System32\drivers\pctEFA.sys
[2011/04/12 13:18:06 | 000,338,880 | -H– | C] (PC Tools) – C:\WINDOWS\System32\drivers\pctDS.sys
[2011/04/12 13:17:53 | 000,000,000 | -H-D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\PC Tools Security
[2011/04/12 12:46:48 | 000,000,000 | -HSD | C] – C:\WINDOWS\CSC
[2011/04/12 12:40:35 | 000,000,000 | -H-D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\SpywareBlaster
[2011/04/12 12:40:33 | 000,000,000 | -H-D | C] – C:\Program Files\SpywareBlaster
[2011/04/12 01:53:31 | 000,000,000 | -H-D | C] – C:\Documents and Settings\Ryan B\Start Menu\Programs\SpyHunter
[2011/04/12 01:53:27 | 000,000,000 | -H-D | C] – C:\sh4ldr
[2011/04/12 01:53:27 | 000,000,000 | -H-D | C] – C:\Program Files\Enigma Software Group
[2011/04/12 01:53:01 | 000,000,000 | -H-D | C] – C:\Program Files\Common Files\Wise Installation Wizard
[2011/04/12 01:31:45 | 000,000,000 | -H-D | C] – C:\Documents and Settings\Ryan B\Start Menu\Programs\Windows Restore
[2011/04/12 01:16:49 | 000,557,056 | -H– | C] (WinSCP) – C:\Documents and Settings\All Users\Application Data\HDFryVTMFjAtTWN.exe
[6 C:\Documents and Settings\Ryan B\My Documents\*.tmp files -> C:\Documents and Settings\Ryan B\My Documents\*.tmp -> ]
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[13 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/04/17 18:48:02 | 000,000,236 | —- | M] () – C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2011/04/17 18:46:50 | 005,689,312 | —- | M] (Support.com ) – C:\Documents and Settings\Ryan B\Desktop\ARO2011_tbt.exe
[2011/04/17 18:45:17 | 000,709,456 | —- | M] () – C:\WINDOWS\is-2H2SU.exe
[2011/04/17 18:45:17 | 000,010,562 | —- | M] () – C:\WINDOWS\is-2H2SU.msg
[2011/04/17 18:45:17 | 000,000,415 | —- | M] () – C:\WINDOWS\is-2H2SU.lst
[2011/04/17 18:31:08 | 000,000,886 | -H– | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/04/17 18:23:24 | 000,002,206 | -H– | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/04/17 18:23:12 | 000,000,882 | -H– | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/04/17 18:22:01 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/04/17 17:36:30 | 000,000,336 | -H– | M] () – C:\Documents and Settings\All Users\Application Data\19783476
[2011/04/17 17:04:57 | 000,479,232 | -H– | M] () – C:\Documents and Settings\All Users\Application Data\19783476.exe
[2011/04/17 16:45:05 | 000,580,608 | -H– | M] (OldTimer Tools) – C:\Documents and Settings\Ryan B\Desktop\OTL.exe
[2011/04/17 16:40:39 | 007,734,240 | -H– | M] (Malwarebytes Corporation ) – C:\Documents and Settings\Ryan B\Desktop\mbam-setup.exe
[2011/04/17 16:35:06 | 001,006,778 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\new1.exe
[2011/04/17 16:35:06 | 001,006,778 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\new.exe
[2011/04/15 18:30:59 | 000,000,336 | -H– | M] () – C:\Documents and Settings\All Users\Application Data\18407220
[2011/04/13 09:15:24 | 000,000,096 | -H– | M] () – C:\Documents and Settings\All Users\Application Data\~19455796
[2011/04/13 09:15:23 | 000,000,128 | -H– | M] () – C:\Documents and Settings\All Users\Application Data\~19455796r
[2011/04/13 07:55:56 | 000,000,811 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\Windows Restore.lnk
[2011/04/13 07:55:52 | 000,000,336 | -H– | M] () – C:\Documents and Settings\All Users\Application Data\19455796
[2011/04/12 23:41:35 | 000,000,951 | -H– | M] () – C:\Documents and Settings\Ryan B\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2011/04/12 23:41:35 | 000,000,933 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\Spybot - Search & Destroy.lnk
[2011/04/12 23:12:45 | 000,000,832 | -H– | M] () – C:\Documents and Settings\Ryan B\Application Data\Microsoft\Internet Explorer\Quick Launch\Trojan Killer.lnk
[2011/04/12 23:12:45 | 000,000,814 | -H– | M] () – C:\Documents and Settings\All Users\Desktop\Trojan Killer.lnk
[2011/04/12 13:18:28 | 000,658,488 | -H– | M] () – C:\WINDOWS\System32\drivers\Cat.DB
[2011/04/12 13:17:54 | 000,001,637 | -H– | M] () – C:\Documents and Settings\All Users\Desktop\Spyware Doctor.lnk
[2011/04/12 13:14:50 | 000,512,992 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\sdasetup_revwire207.exe
[2011/04/12 12:40:35 | 000,000,690 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\SpywareBlaster.lnk
[2011/04/12 01:53:32 | 000,001,975 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\SpyHunter.lnk
[2011/04/12 01:16:49 | 000,557,056 | -H– | M] (WinSCP) – C:\Documents and Settings\All Users\Application Data\HDFryVTMFjAtTWN.exe
[2011/04/12 00:51:16 | 000,046,471 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\myc.jpg
[2011/04/11 16:08:47 | 000,435,828 | -H– | M] () – C:\WINDOWS\System32\perfh009.dat
[2011/04/11 16:08:47 | 000,068,558 | -H– | M] () – C:\WINDOWS\System32\perfc009.dat
[2011/03/28 22:26:50 | 005,084,128 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\03-young-modern-life.mp3
[2011/03/25 19:07:05 | 000,027,356 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\schoolpicture.jpg
[2011/03/23 14:39:59 | 000,030,756 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\after gym.jpg
[2011/03/21 23:33:04 | 000,021,652 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\me4.jpg
[2011/03/20 11:12:29 | 003,128,890 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\2011 Returning Info Form_distributed.pdf
[6 C:\Documents and Settings\Ryan B\My Documents\*.tmp files -> C:\Documents and Settings\Ryan B\My Documents\*.tmp -> ]
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[13 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/04/17 18:48:01 | 000,000,236 | —- | C] () – C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2011/04/17 18:45:17 | 000,709,456 | —- | C] () – C:\WINDOWS\is-2H2SU.exe
[2011/04/17 18:45:17 | 000,010,562 | —- | C] () – C:\WINDOWS\is-2H2SU.msg
[2011/04/17 18:45:17 | 000,000,415 | —- | C] () – C:\WINDOWS\is-2H2SU.lst
[2011/04/17 18:34:56 | 001,006,778 | -H– | C] () – C:\Documents and Settings\Ryan B\Desktop\new1.exe
[2011/04/17 17:36:30 | 000,000,336 | -H– | C] () – C:\Documents and Settings\All Users\Application Data\19783476
[2011/04/17 17:04:57 | 000,479,232 | -H– | C] () – C:\Documents and Settings\All Users\Application Data\19783476.exe
[2011/04/17 16:35:02 | 001,006,778 | -H– | C] () – C:\Documents and Settings\Ryan B\Desktop\new.exe
[2011/04/15 18:30:59 | 000,000,336 | -H– | C] () – C:\Documents and Settings\All Users\Application Data\18407220
[2011/04/13 09:15:23 | 000,000,128 | -H– | C] () – C:\Documents and Settings\All Users\Application Data\~19455796r
[2011/04/13 09:15:23 | 000,000,096 | -H– | C] () – C:\Documents and Settings\All Users\Application Data\~19455796
[2011/04/13 07:55:56 | 000,000,811 | -H– | C] () – C:\Documents and Settings\Ryan B\Desktop\Windows Restore.lnk
[2011/04/13 07:55:52 | 000,000,336 | -H– | C] () – C:\Documents and Settings\All Users\Application Data\19455796
[2011/04/12 23:41:35 | 000,000,951 | -H– | C] () – C:\Documents and Settings\Ryan B\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2011/04/12 23:41:35 | 000,000,933 | -H– | C] () – C:\Documents and Settings\Ryan B\Desktop\Spybot - Search & Destroy.lnk
[2011/04/12 23:12:45 | 000,000,832 | -H– | C] () – C:\Documents and Settings\Ryan B\Application Data\Microsoft\Internet Explorer\Quick Launch\Trojan Killer.lnk
[2011/04/12 22:26:19 | 000,000,814 | -H– | C] () – C:\Documents and Settings\All Users\Desktop\Trojan Killer.lnk
[2011/04/12 13:18:12 | 000,658,488 | -H– | C] () – C:\WINDOWS\System32\drivers\Cat.DB
[2011/04/12 13:17:54 | 000,001,637 | -H– | C] () – C:\Documents and Settings\All Users\Desktop\Spyware Doctor.lnk
[2011/04/12 13:14:59 | 000,512,992 | -H– | C] () – C:\Documents and Settings\Ryan B\Desktop\sdasetup_revwire207.exe
[2011/04/12 12:40:35 | 000,000,690 | -H– | C] () – C:\Documents and Settings\Ryan B\Desktop\SpywareBlaster.lnk
[2011/04/12 01:53:32 | 000,001,975 | -H– | C] () – C:\Documents and Settings\Ryan B\Desktop\SpyHunter.lnk
[2011/04/12 00:51:15 | 000,046,471 | -H– | C] () – C:\Documents and Settings\Ryan B\Desktop\myc.jpg
[2011/03/28 21:51:16 | 005,084,128 | -H– | C] () – C:\Documents and Settings\Ryan B\Desktop\03-young-modern-life.mp3
[2011/03/25 19:07:03 | 000,027,356 | -H– | C] () – C:\Documents and Settings\Ryan B\Desktop\schoolpicture.jpg
[2011/03/23 14:39:58 | 000,030,756 | -H– | C] () – C:\Documents and Settings\Ryan B\Desktop\after gym.jpg
[2011/03/21 23:33:03 | 000,021,652 | -H– | C] () – C:\Documents and Settings\Ryan B\Desktop\me4.jpg
[2011/03/20 11:12:28 | 003,128,890 | -H– | C] () – C:\Documents and Settings\Ryan B\Desktop\2011 Returning Info Form_distributed.pdf
[2010/10/02 12:55:56 | 000,030,424 | -H– | C] () – C:\WINDOWS\System32\wrLZMA.dll
[2010/10/02 12:55:56 | 000,017,472 | -H– | C] () – C:\WINDOWS\System32\SsiEfr.exe
[2010/03/02 01:35:11 | 000,006,144 | -H– | C] () – C:\Documents and Settings\Ryan B\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/12/12 15:11:10 | 000,261,632 | -H– | C] () – C:\WINDOWS\PEV.exe
[2009/12/12 15:11:10 | 000,098,816 | -H– | C] () – C:\WINDOWS\sed.exe
[2009/12/12 15:11:10 | 000,080,412 | -H– | C] () – C:\WINDOWS\grep.exe
[2009/12/12 15:11:10 | 000,077,312 | -H– | C] () – C:\WINDOWS\MBR.exe
[2009/12/12 15:11:10 | 000,068,096 | -H– | C] () – C:\WINDOWS\zip.exe
[2009/09/18 20:13:37 | 000,000,664 | -H– | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2009/08/24 19:36:03 | 000,000,000 | -H– | C] () – C:\WINDOWS\nsreg.dat
[2009/08/24 17:44:11 | 000,086,016 | -H– | C] () – C:\WINDOWS\System32\preflib.dll
[2009/08/24 17:44:09 | 000,020,480 | -H– | C] () – C:\WINDOWS\System32\WLTRYSVC.EXE
[2009/08/24 17:44:08 | 000,757,760 | -H– | C] () – C:\WINDOWS\System32\bcm1xsup.dll
[2009/08/24 16:22:09 | 003,107,788 | -H– | C] () – C:\WINDOWS\System32\ativvaxx.dat
[2009/08/24 16:22:09 | 000,147,685 | -H– | C] () – C:\WINDOWS\System32\atiicdxx.dat
[2009/08/19 21:30:17 | 000,000,174 | -H– | C] () – C:\WINDOWS\wininit.ini
[2009/08/19 20:36:41 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2009/08/19 20:29:30 | 000,021,640 | -H– | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2009/08/19 16:15:27 | 000,004,161 | -H– | C] () – C:\WINDOWS\ODBCINST.INI
[2009/08/19 16:07:20 | 000,267,800 | -H– | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2005/11/18 14:47:26 | 000,000,000 | -H– | C] () – C:\WINDOWS\System32\px.ini
[2005/03/21 19:48:05 | 013,107,200 | -H– | C] () – C:\WINDOWS\System32\oembios.bin
[2005/03/21 19:48:05 | 000,004,627 | -H– | C] () – C:\WINDOWS\System32\oembios.dat
[2004/08/04 06:00:00 | 000,755,200 | -H– | C] () – C:\WINDOWS\System32\ir50_32.dll
[2004/08/04 06:00:00 | 000,673,088 | -H– | C] () – C:\WINDOWS\System32\mlang.dat
[2004/08/04 06:00:00 | 000,435,828 | -H– | C] () – C:\WINDOWS\System32\perfh009.dat
[2004/08/04 06:00:00 | 000,338,432 | -H– | C] () – C:\WINDOWS\System32\ir41_qcx.dll
[2004/08/04 06:00:00 | 000,272,128 | -H– | C] () – C:\WINDOWS\System32\perfi009.dat
[2004/08/04 06:00:00 | 000,218,003 | -H– | C] () – C:\WINDOWS\System32\dssec.dat
[2004/08/04 06:00:00 | 000,200,192 | -H– | C] () – C:\WINDOWS\System32\ir50_qc.dll
[2004/08/04 06:00:00 | 000,183,808 | -H– | C] () – C:\WINDOWS\System32\ir50_qcx.dll
[2004/08/04 06:00:00 | 000,120,320 | -H– | C] () – C:\WINDOWS\System32\ir41_qc.dll
[2004/08/04 06:00:00 | 000,068,558 | -H– | C] () – C:\WINDOWS\System32\perfc009.dat
[2004/08/04 06:00:00 | 000,046,258 | -H– | C] () – C:\WINDOWS\System32\mib.bin
[2004/08/04 06:00:00 | 000,028,626 | -H– | C] () – C:\WINDOWS\System32\perfd009.dat
[2004/08/04 06:00:00 | 000,004,569 | -H– | C] () – C:\WINDOWS\System32\secupd.dat
[2004/08/04 06:00:00 | 000,001,804 | -H– | C] () – C:\WINDOWS\System32\dcache.bin
[2004/08/04 06:00:00 | 000,000,741 | -H– | C] () – C:\WINDOWS\System32\noise.dat

========== LOP Check ==========

[2009/08/24 23:11:17 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\acccore
[2011/01/27 23:22:05 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\Novatel Wireless
[2011/04/17 18:51:26 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2009/08/24 23:11:18 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\Viewpoint
[2010/10/02 12:53:03 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\{5D7316EC-0EDC-4C87-A589-9244C286BC92}
[2009/09/11 16:49:28 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/08/24 23:13:00 | 000,000,000 | -H-D | M] – C:\Documents and Settings\Ryan B\Application Data\acccore
[2011/04/08 02:51:10 | 000,000,000 | -H-D | M] – C:\Documents and Settings\Ryan B\Application Data\FrostWire
[2009/08/20 19:29:39 | 000,000,000 | -H-D | M] – C:\Documents and Settings\Ryan B\Application Data\Leadertech
[2009/10/07 16:05:49 | 000,000,000 | -H-D | M] – C:\Documents and Settings\Ryan B\Application Data\LimeWire
[2009/09/18 21:30:36 | 000,000,000 | -H-D | M] – C:\Documents and Settings\Ryan B\Application Data\Viewpoint
[2011/04/17 18:48:02 | 000,000,236 | —- | M] () – C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2009/08/19 20:33:20 | 000,000,000 | -H– | M] () – C:\AUTOEXEC.BAT
[2009/08/24 14:41:49 | 000,000,223 | -H– | M] () – C:\Boot.bak
[2009/12/12 15:12:25 | 000,000,293 | RHS- | M] () – C:\boot.ini
[2004/08/04 00:00:00 | 000,260,272 | -H– | M] () – C:\cmldr
[2010/03/10 02:31:14 | 000,039,395 | -H– | M] () – C:\ComboFix.txt
[2009/08/19 20:33:20 | 000,000,000 | -H– | M] () – C:\CONFIG.SYS
[2009/08/19 20:33:20 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2009/08/24 23:12:00 | 000,000,462 | -H– | M] () – C:\IPH.PH
[2009/08/19 20:33:20 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2004/08/04 06:00:00 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2009/08/24 13:56:08 | 000,250,048 | RHS- | M] () – C:\ntldr
[2011/04/17 18:21:42 | 1409,286,144 | -HS- | M] () – C:\pagefile.sys
[2011/04/17 18:41:27 | 000,000,564 | -H– | M] () – C:\rkill.log

< %systemroot%\Fonts\*.com >
[2006/04/18 15:39:28 | 000,026,040 | -H– | M] () – C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 14:53:56 | 000,026,489 | -H– | M] () – C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 15:39:28 | 000,029,779 | -H– | M] () – C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 14:58:52 | 000,030,808 | -H– | M] () – C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/08/19 20:32:48 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/07/06 08:06:10 | 000,089,088 | -H– | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2006/10/26 19:56:12 | 000,033,104 | -H– | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\msonpppr.dll
[2008/07/06 06:50:03 | 000,597,504 | -H– | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2009/08/19 16:06:13 | 000,094,208 | -H– | M] () – C:\WINDOWS\system32\config\default.sav
[2009/08/19 16:06:13 | 000,659,456 | -H– | M] () – C:\WINDOWS\system32\config\software.sav
[2009/08/19 16:06:13 | 000,901,120 | -H– | M] () – C:\WINDOWS\system32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2009/08/24 14:01:26 | 000,000,272 | -HS- | M] () – C:\Documents and Settings\All Users\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2009/08/24 14:26:44 | 000,000,119 | -HS- | M] () – C:\Documents and Settings\Ryan B\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2009/08/19 20:40:42 | 000,000,079 | -H– | M] () – C:\Documents and Settings\Ryan B\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >
[2010/03/10 02:22:31 | 003,885,183 | RH– | M] () – C:\Documents and Settings\Ryan B\Desktop\AB.exe.exe
[2011/04/17 18:46:50 | 005,689,312 | —- | M] (Support.com ) – C:\Documents and Settings\Ryan B\Desktop\ARO2011_tbt.exe
[2011/04/17 16:40:39 | 007,734,240 | -H– | M] (Malwarebytes Corporation ) – C:\Documents and Settings\Ryan B\Desktop\mbam-setup.exe
[2011/04/17 16:35:06 | 001,006,778 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\new.exe
[2011/04/17 16:35:06 | 001,006,778 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\new1.exe
[2011/04/17 16:45:05 | 000,580,608 | -H– | M] (OldTimer Tools) – C:\Documents and Settings\Ryan B\Desktop\OTL.exe
[2011/04/12 13:14:50 | 000,512,992 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\sdasetup_revwire207.exe
[2009/08/24 16:57:02 | 000,253,952 | -H– | M] (Phoenix Technologies, Ltd.) – C:\Documents and Settings\Ryan B\Desktop\WINPHLASH.EXE

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2009/08/24 14:26:44 | 000,000,122 | -HS- | M] () – C:\Documents and Settings\Ryan B\Favorites\Desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >
[2011/04/17 18:47:59 | 000,065,536 | -HS- | M] () – C:\Documents and Settings\Ryan B\Cookies\index.dat

< %SystemRoot%\system32\fonts\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-03-25 15:16:43

< >

========== Alternate Data Streams ==========

@Alternate Data Stream - 149 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2

< End of report >

ksc89

Post #10April 18, 2011, 7:40 PM UTC

I figured out how to get the new report. There was a saved report on my desktop that was opening up at the end of the report. I deleted that and was able to get a newer report…. Here it is (from OTL)…

OTL logfile created on: 4/18/2011 3:36:26 PM - Run 3
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Ryan B\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

894.00 Mb Total Physical Memory | 424.00 Mb Available Physical Memory | 47.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 80.00% Paging File free
Paging file location(s): C:\pagefile.sys 1344 2688 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 111.70 Gb Total Space | 86.22 Gb Free Space | 77.19% Space Free | Partition Type: NTFS

Computer Name: RYAN | User Name: Ryan B | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Ryan B\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Webroot\Security\Current\Framework\WRConsumerService.exe (Webroot Software, Inc. )
PRC - C:\Program Files\Webroot\Security\Current\Framework\WRTray.exe (Webroot Software, Inc. )
PRC - C:\Program Files\Webroot\Security\Current\plugins\antimalware\AEI.exe (Webroot Software, Inc. (www.webroot.com))
PRC - C:\Program Files\AIM6\aim6.exe (AOL LLC)
PRC - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
PRC - C:\Program Files\AIM6\aolsoftware.exe (AOL LLC)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\SigmaTel\C-Major Audio\DellXPM_5515v131\WDM\stacsv.exe (SigmaTel, Inc.)
PRC - C:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exe (SigmaTel, Inc.)
PRC - C:\Program Files\Viewpoint\Common\ViewpointService.exe (Viewpoint Corporation)
PRC - C:\WINDOWS\system32\DLA\DLACTRLW.EXE (Sonic Solutions)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Ryan B\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll (Microsoft Corporation)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_473666fd\ATL80.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (HidServ) – File not found
SRV - (WRConsumerService) – C:\Program Files\Webroot\Security\Current\Framework\WRConsumerService.exe (Webroot Software, Inc. )
SRV - (WebrootSpySweeperService) – C:\Program Files\Webroot\Security\current\plugins\antimalware\AEI.exe (Webroot Software, Inc. (www.webroot.com))
SRV - (YahooAUService) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
SRV - (STacSV) – C:\Program Files\SigmaTel\C-Major Audio\DellXPM_5515v131\WDM\stacsv.exe (SigmaTel, Inc.)
SRV - (Viewpoint Manager Service) – C:\Program Files\Viewpoint\Common\ViewpointService.exe (Viewpoint Corporation)

========== Driver Services (SafeList) ==========

DRV - (PCTCore) – C:\WINDOWS\system32\drivers\PCTCore.sys (PC Tools)
DRV - (SSIDRV) – C:\WINDOWS\SYSTEM32\Drivers\SSIDRV.SYS (Webroot Software, Inc. (www.webroot.com))
DRV - (SSFMONM) – C:\WINDOWS\system32\drivers\ssfmonm.sys (Webroot Software, Inc. (www.webroot.com))
DRV - (SSHRMD) – C:\WINDOWS\SYSTEM32\Drivers\SSHRMD.SYS (Webroot Software, Inc. (www.webroot.com))
DRV - (NwlnkIpx) – C:\WINDOWS\system32\drivers\nwlnkipx.sys (Microsoft Corporation)
DRV - (STHDA) – C:\WINDOWS\system32\drivers\sthda.sys (SigmaTel, Inc.)
DRV - (BCM43XX) – C:\WINDOWS\system32\drivers\BCMWL5.SYS (Broadcom Corporation)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (bcm4sbxp) – C:\WINDOWS\system32\drivers\bcm4sbxp.sys (Broadcom Corporation)
DRV - (rimmptsk) – C:\WINDOWS\system32\drivers\rimmptsk.sys (REDC)
DRV - (AmdK8) – C:\WINDOWS\system32\drivers\AmdK8.sys (Advanced Micro Devices)
DRV - (PCASp50) – C:\WINDOWS\system32\drivers\PCASp50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (NWADI) – C:\WINDOWS\system32\drivers\NWADIenum.sys (Novatel Wireless Inc)
DRV - (DLAUDFAM) – C:\WINDOWS\system32\DLA\DLAUDFAM.SYS (Sonic Solutions)
DRV - (DLAUDF_M) – C:\WINDOWS\system32\DLA\DLAUDF_M.SYS (Sonic Solutions)
DRV - (DLAIFS_M) – C:\WINDOWS\system32\DLA\DLAIFS_M.SYS (Sonic Solutions)
DRV - (DLABOIOM) – C:\WINDOWS\system32\DLA\DLABOIOM.SYS (Sonic Solutions)
DRV - (DLAOPIOM) – C:\WINDOWS\system32\DLA\DLAOPIOM.SYS (Sonic Solutions)
DRV - (DLAPoolM) – C:\WINDOWS\system32\DLA\DLAPoolM.SYS (Sonic Solutions)
DRV - (DLADResN) – C:\WINDOWS\system32\DLA\DLADResN.SYS (Sonic Solutions)
DRV - (DLACDBHM) – C:\WINDOWS\system32\drivers\DLACDBHM.SYS (Sonic Solutions)
DRV - (DLARTL_N) – C:\WINDOWS\system32\drivers\DLARTL_N.SYS (Sonic Solutions)
DRV - (NwlnkNb) – C:\WINDOWS\system32\drivers\nwlnknb.sys (Microsoft Corporation)
DRV - (NwlnkSpx) – C:\WINDOWS\system32\drivers\nwlnkspx.sys (Microsoft Corporation)
DRV - (ADM8511) – C:\WINDOWS\system32\drivers\ADM8511.SYS (ADMtek Incorporated)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\..\URLSearchHook: {472734EA-242A-422b-ADF8-83D1E48CC825} - Reg Error: Key error. File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

FF - HKLM\software\mozilla\Mozilla Firefox 3.5.18\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/03/27 14:29:55 | 000,000,000 | -H-D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.18\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/03/23 14:24:54 | 000,000,000 | -H-D | M]

[2009/10/26 14:16:37 | 000,000,000 | -H-D | M] (No name found) – C:\Documents and Settings\Ryan B\Application Data\Mozilla\Extensions
[2011/04/17 18:47:54 | 000,000,000 | -H-D | M] (No name found) – C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\extensions
[2009/12/02 22:23:30 | 000,000,000 | -H-D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/04/17 18:48:04 | 000,000,000 | -H-D | M] (Support.com Toolbar) – C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\extensions\[removed]
[2011/04/17 12:15:35 | 000,000,000 | -H-D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2010/01/23 19:10:11 | 000,000,000 | -H-D | M] (Move Media Player) – C:\DOCUMENTS AND SETTINGS\RYAN B\APPLICATION DATA\MOVE NETWORKS
[2009/09/12 22:08:29 | 000,000,000 | -H-D | M] (Java Quick Starter) – C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2007/04/16 13:07:12 | 000,180,293 | -H– | M] () – C:\Program Files\Mozilla Firefox\plugins\npViewpoint.dll

O1 HOSTS File: ([2011/04/18 13:50:57 | 000,000,027 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (&Yahoo;! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\DLA\DLASHX_W.DLL (Sonic Solutions)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE (Sonic Solutions)
O4 - HKLM..\Run: [ISTray] File not found
O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exe (SigmaTel, Inc.)
O4 - HKLM..\Run: [WebrootTrayApp] C:\Program Files\Webroot\Security\Current\Framework\WRTray.exe (Webroot Software, Inc. )
O4 - HKCU..\Run: [Aim6] C:\Program Files\AIM6\aim6.exe (AOL LLC)
O4 - HKCU..\Run: [HDFryVTMFjAtTWN] File not found
O4 - HKCU..\Run: [Messenger (Yahoo!)] C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited)
O4 - HKCU..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_15)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\Ryan B\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Ryan B\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/08/19 20:33:20 | 000,000,000 | -H– | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/04/18 15:36:21 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2011/04/18 13:47:36 | 000,000,000 | —D | C] – C:\WINDOWS\temp
[2011/04/18 13:42:03 | 000,000,000 | —D | C] – C:\ComboFix
[2011/04/18 13:28:18 | 000,020,952 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2011/04/18 11:39:55 | 000,000,000 | —D | C] – C:\_OTL
[2011/04/18 11:38:22 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Ryan B\Recent
[2011/04/17 22:27:06 | 000,000,000 | -H-D | C] – C:\WINDOWS\System32\appmgmt
[2011/04/17 22:26:37 | 000,000,000 | —D | C] – C:\Config.Msi
[2011/04/17 18:47:54 | 000,000,000 | -H-D | C] – C:\Program Files\Ask.com
[2011/04/17 18:46:50 | 005,689,312 | -H– | C] (Support.com ) – C:\Documents and Settings\Ryan B\Desktop\ARO2011_tbt.exe
[2011/04/17 16:45:02 | 000,580,608 | -H– | C] (OldTimer Tools) – C:\Documents and Settings\Ryan B\Desktop\OTL.exe
[2011/04/17 16:40:39 | 007,734,240 | -H– | C] (Malwarebytes Corporation ) – C:\Documents and Settings\Ryan B\Desktop\mbam-setup.exe
[2011/04/12 23:41:35 | 000,000,000 | -H-D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Spybot - Search & Destroy
[2011/04/12 23:41:27 | 000,000,000 | -H-D | C] – C:\Program Files\Spybot - Search & Destroy
[2011/04/12 23:41:27 | 000,000,000 | -H-D | C] – C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
[2011/04/12 22:25:50 | 000,000,000 | -H-D | C] – C:\Program Files\GridinSoft Trojan Killer
[2011/04/12 12:46:48 | 000,000,000 | -HSD | C] – C:\WINDOWS\CSC
[2011/04/12 12:40:35 | 000,000,000 | -H-D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\SpywareBlaster
[2011/04/12 12:40:33 | 000,000,000 | -H-D | C] – C:\Program Files\SpywareBlaster
[2011/04/12 01:53:27 | 000,000,000 | -H-D | C] – C:\Program Files\Enigma Software Group
[2011/04/12 01:53:01 | 000,000,000 | -H-D | C] – C:\Program Files\Common Files\Wise Installation Wizard

========== Files - Modified Within 30 Days ==========

[2011/04/18 15:31:00 | 000,000,886 | -H– | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/04/18 15:01:00 | 000,000,236 | -H– | M] () – C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2011/04/18 13:51:31 | 000,002,206 | -H– | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/04/18 13:50:57 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2011/04/18 13:50:17 | 000,000,882 | -H– | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/04/18 13:49:32 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/04/18 12:10:09 | 004,324,176 | R— | M] () – C:\Documents and Settings\Ryan B\Desktop\ComboFix.exe
[2011/04/17 19:27:39 | 000,709,456 | —- | M] () – C:\WINDOWS\is-E7D5J.exe
[2011/04/17 19:27:39 | 000,010,562 | —- | M] () – C:\WINDOWS\is-E7D5J.msg
[2011/04/17 19:27:39 | 000,000,347 | —- | M] () – C:\WINDOWS\is-E7D5J.lst
[2011/04/17 18:46:50 | 005,689,312 | -H– | M] (Support.com ) – C:\Documents and Settings\Ryan B\Desktop\ARO2011_tbt.exe
[2011/04/17 16:45:05 | 000,580,608 | -H– | M] (OldTimer Tools) – C:\Documents and Settings\Ryan B\Desktop\OTL.exe
[2011/04/17 16:40:39 | 007,734,240 | -H– | M] (Malwarebytes Corporation ) – C:\Documents and Settings\Ryan B\Desktop\mbam-setup.exe
[2011/04/17 16:35:06 | 001,006,778 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\new1.exe
[2011/04/17 16:35:06 | 001,006,778 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\new.exe
[2011/04/15 18:30:59 | 000,000,336 | -H– | M] () – C:\Documents and Settings\All Users\Application Data\18407220
[2011/04/13 09:15:24 | 000,000,096 | -H– | M] () – C:\Documents and Settings\All Users\Application Data\~19455796
[2011/04/13 09:15:23 | 000,000,128 | -H– | M] () – C:\Documents and Settings\All Users\Application Data\~19455796r
[2011/04/13 07:55:56 | 000,000,811 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\Windows Restore.lnk
[2011/04/13 07:55:52 | 000,000,336 | -H– | M] () – C:\Documents and Settings\All Users\Application Data\19455796
[2011/04/12 23:41:35 | 000,000,951 | -H– | M] () – C:\Documents and Settings\Ryan B\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2011/04/12 23:41:35 | 000,000,933 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\Spybot - Search & Destroy.lnk
[2011/04/12 13:18:28 | 000,658,488 | -H– | M] () – C:\WINDOWS\System32\drivers\Cat.DB
[2011/04/12 13:14:50 | 000,512,992 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\sdasetup_revwire207.exe
[2011/04/12 12:40:35 | 000,000,690 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\SpywareBlaster.lnk
[2011/04/12 00:51:16 | 000,046,471 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\myc.jpg
[2011/04/11 16:08:47 | 000,435,828 | -H– | M] () – C:\WINDOWS\System32\perfh009.dat
[2011/04/11 16:08:47 | 000,068,558 | -H– | M] () – C:\WINDOWS\System32\perfc009.dat
[2011/03/28 22:26:50 | 005,084,128 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\03-young-modern-life.mp3
[2011/03/25 19:07:05 | 000,027,356 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\schoolpicture.jpg
[2011/03/23 14:39:59 | 000,030,756 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\after gym.jpg
[2011/03/21 23:33:04 | 000,021,652 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\me4.jpg
[2011/03/20 11:12:29 | 003,128,890 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\2011 Returning Info Form_distributed.pdf

========== Files Created - No Company Name ==========

[2011/04/18 12:09:55 | 004,324,176 | R— | C] () – C:\Documents and Settings\Ryan B\Desktop\ComboFix.exe
[2011/04/17 19:27:39 | 000,709,456 | —- | C] () – C:\WINDOWS\is-E7D5J.exe
[2011/04/17 19:27:39 | 000,010,562 | —- | C] () – C:\WINDOWS\is-E7D5J.msg
[2011/04/17 19:27:39 | 000,000,347 | —- | C] () – C:\WINDOWS\is-E7D5J.lst
[2011/04/17 18:48:01 | 000,000,236 | -H– | C] () – C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2011/04/17 18:34:56 | 001,006,778 | -H– | C] () – C:\Documents and Settings\Ryan B\Desktop\new1.exe
[2011/04/17 16:35:02 | 001,006,778 | -H– | C] () – C:\Documents and Settings\Ryan B\Desktop\new.exe
[2011/04/15 18:30:59 | 000,000,336 | -H– | C] () – C:\Documents and Settings\All Users\Application Data\18407220
[2011/04/13 09:15:23 | 000,000,128 | -H– | C] () – C:\Documents and Settings\All Users\Application Data\~19455796r
[2011/04/13 09:15:23 | 000,000,096 | -H– | C] () – C:\Documents and Settings\All Users\Application Data\~19455796
[2011/04/13 07:55:56 | 000,000,811 | -H– | C] () – C:\Documents and Settings\Ryan B\Desktop\Windows Restore.lnk
[2011/04/13 07:55:52 | 000,000,336 | -H– | C] () – C:\Documents and Settings\All Users\Application Data\19455796
[2011/04/12 23:41:35 | 000,000,951 | -H– | C] () – C:\Documents and Settings\Ryan B\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2011/04/12 23:41:35 | 000,000,933 | -H– | C] () – C:\Documents and Settings\Ryan B\Desktop\Spybot - Search & Destroy.lnk
[2011/04/12 13:18:12 | 000,658,488 | -H– | C] () – C:\WINDOWS\System32\drivers\Cat.DB
[2011/04/12 13:14:59 | 000,512,992 | -H– | C] () – C:\Documents and Settings\Ryan B\Desktop\sdasetup_revwire207.exe
[2011/04/12 12:40:35 | 000,000,690 | -H– | C] () – C:\Documents and Settings\Ryan B\Desktop\SpywareBlaster.lnk
[2011/04/12 00:51:15 | 000,046,471 | -H– | C] () – C:\Documents and Settings\Ryan B\Desktop\myc.jpg
[2011/03/28 21:51:16 | 005,084,128 | -H– | C] () – C:\Documents and Settings\Ryan B\Desktop\03-young-modern-life.mp3
[2011/03/25 19:07:03 | 000,027,356 | -H– | C] () – C:\Documents and Settings\Ryan B\Desktop\schoolpicture.jpg
[2011/03/23 14:39:58 | 000,030,756 | -H– | C] () – C:\Documents and Settings\Ryan B\Desktop\after gym.jpg
[2011/03/21 23:33:03 | 000,021,652 | -H– | C] () – C:\Documents and Settings\Ryan B\Desktop\me4.jpg
[2011/03/20 11:12:28 | 003,128,890 | -H– | C] () – C:\Documents and Settings\Ryan B\Desktop\2011 Returning Info Form_distributed.pdf
[2010/10/02 12:55:56 | 000,030,424 | -H– | C] () – C:\WINDOWS\System32\wrLZMA.dll
[2010/10/02 12:55:56 | 000,017,472 | -H– | C] () – C:\WINDOWS\System32\SsiEfr.exe
[2010/03/02 01:35:11 | 000,006,144 | -H– | C] () – C:\Documents and Settings\Ryan B\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/12/12 15:11:10 | 000,261,632 | -H– | C] () – C:\WINDOWS\PEV.exe
[2009/12/12 15:11:10 | 000,098,816 | -H– | C] () – C:\WINDOWS\sed.exe
[2009/12/12 15:11:10 | 000,080,412 | -H– | C] () – C:\WINDOWS\grep.exe
[2009/12/12 15:11:10 | 000,077,312 | -H– | C] () – C:\WINDOWS\MBR.exe
[2009/12/12 15:11:10 | 000,068,096 | -H– | C] () – C:\WINDOWS\zip.exe
[2009/09/18 20:13:37 | 000,000,664 | -H– | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2009/08/24 20:07:43 | 000,038,224 | —- | C] () – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/08/24 19:36:03 | 000,000,000 | -H– | C] () – C:\WINDOWS\nsreg.dat
[2009/08/24 17:44:11 | 000,086,016 | -H– | C] () – C:\WINDOWS\System32\preflib.dll
[2009/08/24 17:44:09 | 000,020,480 | -H– | C] () – C:\WINDOWS\System32\WLTRYSVC.EXE
[2009/08/24 17:44:08 | 000,757,760 | -H– | C] () – C:\WINDOWS\System32\bcm1xsup.dll
[2009/08/24 16:22:09 | 003,107,788 | -H– | C] () – C:\WINDOWS\System32\ativvaxx.dat
[2009/08/24 16:22:09 | 000,147,685 | -H– | C] () – C:\WINDOWS\System32\atiicdxx.dat
[2009/08/19 21:30:17 | 000,000,174 | -H– | C] () – C:\WINDOWS\wininit.ini
[2009/08/19 20:36:41 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2009/08/19 20:29:30 | 000,021,640 | -H– | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2009/08/19 16:15:27 | 000,004,161 | -H– | C] () – C:\WINDOWS\ODBCINST.INI
[2009/08/19 16:07:20 | 000,267,800 | -H– | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2005/11/18 14:47:26 | 000,000,000 | -H– | C] () – C:\WINDOWS\System32\px.ini
[2005/03/21 19:48:05 | 013,107,200 | -H– | C] () – C:\WINDOWS\System32\oembios.bin
[2005/03/21 19:48:05 | 000,004,627 | -H– | C] () – C:\WINDOWS\System32\oembios.dat
[2004/08/04 06:00:00 | 000,673,088 | -H– | C] () – C:\WINDOWS\System32\mlang.dat
[2004/08/04 06:00:00 | 000,435,828 | -H– | C] () – C:\WINDOWS\System32\perfh009.dat
[2004/08/04 06:00:00 | 000,272,128 | -H– | C] () – C:\WINDOWS\System32\perfi009.dat
[2004/08/04 06:00:00 | 000,218,003 | -H– | C] () – C:\WINDOWS\System32\dssec.dat
[2004/08/04 06:00:00 | 000,068,558 | -H– | C] () – C:\WINDOWS\System32\perfc009.dat
[2004/08/04 06:00:00 | 000,046,258 | -H– | C] () – C:\WINDOWS\System32\mib.bin
[2004/08/04 06:00:00 | 000,028,626 | -H– | C] () – C:\WINDOWS\System32\perfd009.dat
[2004/08/04 06:00:00 | 000,004,569 | -H– | C] () – C:\WINDOWS\System32\secupd.dat
[2004/08/04 06:00:00 | 000,001,804 | -H– | C] () – C:\WINDOWS\System32\dcache.bin
[2004/08/04 06:00:00 | 000,000,741 | -H– | C] () – C:\WINDOWS\System32\noise.dat

========== Alternate Data Streams ==========

@Alternate Data Stream - 109 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2

< End of report >

mowman

Post #11April 18, 2011, 11:26 PM UTC

Please download and scan with SUPERAntiSpyware Free

Double-click SUPERAntiSypware.exe and use the default settings for installation.
An icon will be created on your desktop. Double-click that icon to launch the program.
If it will not start, go to Start > All Prgrams > SUPERAntiSpyware and click on Alternate Start.
If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download them from here. Double-click on the hyperlink for Download Installer and save SASDEFINITIONS.EXE to your desktop. Then double-click on SASDEFINITIONS.EXE to install the definitions.)
In the Main Menu, click the Preferences… button.
Click the "General and Startup" tab, and under Start-up Options, make sure "Start SUPERAntiSpyware when Windows starts" box is unchecked.
Click the "Scanning Control" tab, and under Scanner Options, make sure the following are checked (uncheck all others):
- Close browsers before scanning.
- Scan for tracking cookies.
- Terminate memory threats before quarantining.
Click the "Close" button to leave the control center screen and exit the program.
Do not run a scan just yet.

Reboot your computer in "Safe Mode" using the F8 method. To do this, restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly. A menu will appear with several options. Use the arrow keys to navigate and select the option to run Windows in "Safe Mode". When logging in, log in under the account that you normally use; do NOT log in under the account titled "Admin" or "Administrator" unless this account is the one used normally.

Scan with SUPERAntiSpyware as follows:

Launch the program and back on the main screen, under "Scan for Harmful Software" click Scan your computer.
On the left, make sure you check C:\Fixed Drive.
On the right, under "Complete Scan", choose Perform Complete Scan and click "Next".
After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".
Make sure everything has a checkmark next to it and click "Next".
A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
If asked if you want to reboot, click "Yes" and reboot normally.
To retrieve the removal information after reboot, launch SUPERAntispyware again.
- Click Preferences, then click the Statistics/Logs tab.
- Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
- If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
- Please copy and paste the Scan Log results in your next reply.
Click Close to exit the program.

ksc89

Post #12April 20, 2011, 1:10 AM UTC

Here is my superantispyware scan log…..

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 04/19/2011 at 03:29 PM

Application Version : 4.50.1002

Core Rules Database Version : 6869
Trace Rules Database Version: 4681

Scan type : Complete Scan
Total Scan Time : 04:23:27

Memory items scanned : 256
Memory threats detected : 0
Registry items scanned : 6457
Registry threats detected : 0
File items scanned : 54723
File threats detected : 180

Adware.Tracking Cookie
C:\Documents and Settings\Ryan B\Cookies\[removed][2].txt
C:\Documents and Settings\Ryan B\Cookies\[removed][1].txt
C:\Documents and Settings\Ryan B\Cookies\ryan_b@interclick[2].txt
C:\Documents and Settings\Ryan B\Cookies\[removed][2].txt
C:\Documents and Settings\Ryan B\Cookies\[removed][1].txt
C:\Documents and Settings\Ryan B\Cookies\[removed][1].txt
C:\Documents and Settings\Ryan B\Cookies\ryan_b@invitemedia[2].txt
.advertising.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.atdmt.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.atdmt.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.atdmt.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.atdmt.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.doubleclick.net [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
ad.yieldmanager.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
ad.yieldmanager.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
ad.yieldmanager.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.invitemedia.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.invitemedia.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.invitemedia.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.invitemedia.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.invitemedia.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.invitemedia.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.invitemedia.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
ad.yieldmanager.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
ad.yieldmanager.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.serving-sys.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.serving-sys.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.apmebf.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.fastclick.net [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.fastclick.net [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.fastclick.net [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.content.yieldmanager.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.fastclick.net [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.interclick.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.interclick.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.a1.interclick.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.a1.interclick.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.a1.interclick.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.interclick.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.zedo.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.zedo.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.zedo.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.adbrite.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.adbrite.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.imrworldwide.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.imrworldwide.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.2o7.net [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.adserver.adtechus.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.adserver.adtechus.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.adserver.adtechus.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.mediaplex.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.mediaplex.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.tribalfusion.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.adserver.adtechus.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.adserver.adtechus.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.advertising.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.advertising.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.advertising.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.advertising.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.serving-sys.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.serving-sys.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
user.lucidmedia.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.advertising.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.adbrite.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.mediabrandsww.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.yieldmanager.net [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.media6degrees.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.media6degrees.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.statcounter.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.revsci.net [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.trafficmp.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.trafficmp.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.trafficmp.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.trafficmp.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.trafficmp.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.trafficmp.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.ads.pointroll.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.pointroll.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.pointroll.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.ads.pointroll.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.ads.pointroll.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.ads.pointroll.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.ads.pointroll.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.ads.pointroll.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.ads.pointroll.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.questionmarket.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.fastclick.net [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.advertising.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.collective-media.net [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.collective-media.net [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.collective-media.net [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.collective-media.net [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.revenue.net [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.invitemedia.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.at.atwola.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.tacoda.at.atwola.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.tacoda.at.atwola.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.tacoda.at.atwola.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.at.atwola.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.perf.overture.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.liveperson.net [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.liveperson.net [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.ihg.db.advertising.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.adviva.net [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.adviva.net [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.marriottinternational.122.2o7.net [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.media6degrees.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.media6degrees.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.media6degrees.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.revsci.net [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.collective-media.net [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.collective-media.net [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.hisfirstgaysexblog.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.hisfirstgaysexblog.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.gostats.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.adbrite.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.adbrite.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.hotblackmennakedlatinboyscock.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.hotblackmennakedlatinboyscock.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
track.hunkdujour.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
www.hotblackmennakedlatinboyscock.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
www.hotblackmennakedlatinboyscock.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
www.hotblackmennakedlatinboyscock.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
www.hotblackmennakedlatinboyscock.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
www.hotblackmennakedlatinboyscock.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
www.hotblackmennakedlatinboyscock.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
www.hotblackmennakedlatinboyscock.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
oldpervertssexson.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
www.gayporntgp.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
grandpafuckgrandson.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.trafficholder.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.trafficholder.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.trafficholder.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.trafficholder.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.www.burstnet.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
www.burstnet.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
www.burstbeacon.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.burstnet.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.media6degrees.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.advertise.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.stopzilla.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.stopzilla.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.stopzilla.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
www.stopzilla.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
sdesapio-conversiontracker.appspot.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
sdesapio-conversiontracker.appspot.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
sdesapio-conversiontracker.appspot.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
sdesapio-conversiontracker.appspot.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
www.icityfind.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
www.plomedia.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.findstuff.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.trafficmp.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.ads.pointroll.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
bridge1.admarketplace.net [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.admarketplace.net [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.mm.chitika.net [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.r1-ads.ace.advertising.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
www.googleadservices.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
www.cpcadnet.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.revsci.net [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.eyewonder.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.eyewonder.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.invitemedia.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.kontera.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.legolas-media.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.legolas-media.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.media6degrees.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.kontera.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.kontera.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.questionmarket.com [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.revsci.net [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.revsci.net [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.revsci.net [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.yadro.ru [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.yadro.ru [ C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\cookies.sqlite ]
.revsci.net [ C:\Documents and Settings\Visitor\Application Data\Mozilla\Firefox\Profiles\nysf0fic.default\cookies.sqlite ]
.revsci.net [ C:\Documents and Settings\Visitor\Application Data\Mozilla\Firefox\Profiles\nysf0fic.default\cookies.sqlite ]
.revsci.net [ C:\Documents and Settings\Visitor\Application Data\Mozilla\Firefox\Profiles\nysf0fic.default\cookies.sqlite ]
.revsci.net [ C:\Documents and Settings\Visitor\Application Data\Mozilla\Firefox\Profiles\nysf0fic.default\cookies.sqlite ]

Trojan.Agent/Gen-FakeAlert[WinsCP]
C:\_OTL\MOVEDFILES\04182011_113955\C_DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\HDFRYVTMFJATTWN.EXE

mowman

Post #13April 20, 2011, 1:50 AM UTC

Run OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:Services

:Otl
O4 - HKCU..\Run: [HDFryVTMFjAtTWN] File not found
[2011/04/15 18:30:59 | 000,000,336 | -H– | M] () – C:\Documents and Settings\All Users\Application Data\18407220
[2011/04/13 09:15:24 | 000,000,096 | -H– | M] () – C:\Documents and Settings\All Users\Application Data\~19455796
[2011/04/13 09:15:23 | 000,000,128 | -H– | M] () – C:\Documents and Settings\All Users\Application Data\~19455796r
[2011/04/13 07:55:56 | 000,000,811 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\Windows Restore.lnk
[2011/04/13 07:55:52 | 000,000,336 | -H– | M] () – C:\Documents and Settings\All Users\Application Data\19455796
@Alternate Data Stream - 109 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2

:Commands
[emptytemp]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )

Please scan the following files

Please visit Virus Total by clicking here.
Click the Browse button and search for the following file: C:\Documents and Settings\Ryan B\Desktop\new1.exe
Click Open.
Then click Send File.
Please be patient while the file is scanned.
If Virus Total tells you that the file has already been scanned, click "reanalyse now".

Once the scan results appear, copy and paste them into Notepad and repeat the procedure for the following file(s):
C:\WINDOWS\is-E7D5J.exe
C:\Documents and Settings\Ryan B\Desktop\new.exe
Please provide the results from the scans in your next reply.

ksc89

Post #14April 20, 2011, 3:26 AM UTC

Here is my new OTL log….I could not find any information for the file C:\WINDOWS\is-E7D5J.exe on virus total….Also, my results for the other 2 files are posted…

OTL logfile created on: 4/19/2011 11:05:45 PM - Run 4
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Ryan B\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

894.00 Mb Total Physical Memory | 365.00 Mb Available Physical Memory | 41.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 78.00% Paging File free
Paging file location(s): C:\pagefile.sys 1344 2688 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 111.70 Gb Total Space | 86.09 Gb Free Space | 77.07% Space Free | Partition Type: NTFS

Computer Name: RYAN | User Name: Ryan B | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Ryan B\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Webroot\Security\Current\Framework\WRConsumerService.exe (Webroot Software, Inc. )
PRC - C:\Program Files\Webroot\Security\Current\Framework\WRTray.exe (Webroot Software, Inc. )
PRC - C:\Program Files\Webroot\Security\Current\plugins\antimalware\AEI.exe (Webroot Software, Inc. (www.webroot.com))
PRC - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ytbb.exe (Yahoo! Inc.)
PRC - C:\Program Files\AIM6\aim6.exe (AOL LLC)
PRC - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited)
PRC - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
PRC - C:\Program Files\AIM6\aolsoftware.exe (AOL LLC)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\SigmaTel\C-Major Audio\DellXPM_5515v131\WDM\stacsv.exe (SigmaTel, Inc.)
PRC - C:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exe (SigmaTel, Inc.)
PRC - C:\Program Files\Viewpoint\Common\ViewpointService.exe (Viewpoint Corporation)
PRC - C:\WINDOWS\system32\DLA\DLACTRLW.EXE (Sonic Solutions)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Ryan B\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (HidServ) – File not found
SRV - (WRConsumerService) – C:\Program Files\Webroot\Security\Current\Framework\WRConsumerService.exe (Webroot Software, Inc. )
SRV - (WebrootSpySweeperService) – C:\Program Files\Webroot\Security\current\plugins\antimalware\AEI.exe (Webroot Software, Inc. (www.webroot.com))
SRV - (YahooAUService) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
SRV - (STacSV) – C:\Program Files\SigmaTel\C-Major Audio\DellXPM_5515v131\WDM\stacsv.exe (SigmaTel, Inc.)
SRV - (Viewpoint Manager Service) – C:\Program Files\Viewpoint\Common\ViewpointService.exe (Viewpoint Corporation)

========== Driver Services (SafeList) ==========

DRV - (PCTCore) – C:\WINDOWS\system32\drivers\PCTCore.sys (PC Tools)
DRV - (SSIDRV) – C:\WINDOWS\SYSTEM32\Drivers\SSIDRV.SYS (Webroot Software, Inc. (www.webroot.com))
DRV - (SSFMONM) – C:\WINDOWS\system32\drivers\ssfmonm.sys (Webroot Software, Inc. (www.webroot.com))
DRV - (SSHRMD) – C:\WINDOWS\SYSTEM32\Drivers\SSHRMD.SYS (Webroot Software, Inc. (www.webroot.com))
DRV - (SASKUTIL) – C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASDIFSV) – C:\Program Files\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (NwlnkIpx) – C:\WINDOWS\system32\drivers\nwlnkipx.sys (Microsoft Corporation)
DRV - (STHDA) – C:\WINDOWS\system32\drivers\sthda.sys (SigmaTel, Inc.)
DRV - (BCM43XX) – C:\WINDOWS\system32\drivers\BCMWL5.SYS (Broadcom Corporation)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (bcm4sbxp) – C:\WINDOWS\system32\drivers\bcm4sbxp.sys (Broadcom Corporation)
DRV - (rimmptsk) – C:\WINDOWS\system32\drivers\rimmptsk.sys (REDC)
DRV - (AmdK8) – C:\WINDOWS\system32\drivers\AmdK8.sys (Advanced Micro Devices)
DRV - (PCASp50) – C:\WINDOWS\system32\drivers\PCASp50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (NWADI) – C:\WINDOWS\system32\drivers\NWADIenum.sys (Novatel Wireless Inc)
DRV - (DLAUDFAM) – C:\WINDOWS\system32\DLA\DLAUDFAM.SYS (Sonic Solutions)
DRV - (DLAUDF_M) – C:\WINDOWS\system32\DLA\DLAUDF_M.SYS (Sonic Solutions)
DRV - (DLAIFS_M) – C:\WINDOWS\system32\DLA\DLAIFS_M.SYS (Sonic Solutions)
DRV - (DLABOIOM) – C:\WINDOWS\system32\DLA\DLABOIOM.SYS (Sonic Solutions)
DRV - (DLAOPIOM) – C:\WINDOWS\system32\DLA\DLAOPIOM.SYS (Sonic Solutions)
DRV - (DLAPoolM) – C:\WINDOWS\system32\DLA\DLAPoolM.SYS (Sonic Solutions)
DRV - (DLADResN) – C:\WINDOWS\system32\DLA\DLADResN.SYS (Sonic Solutions)
DRV - (DLACDBHM) – C:\WINDOWS\system32\drivers\DLACDBHM.SYS (Sonic Solutions)
DRV - (DLARTL_N) – C:\WINDOWS\system32\drivers\DLARTL_N.SYS (Sonic Solutions)
DRV - (NwlnkNb) – C:\WINDOWS\system32\drivers\nwlnknb.sys (Microsoft Corporation)
DRV - (NwlnkSpx) – C:\WINDOWS\system32\drivers\nwlnkspx.sys (Microsoft Corporation)
DRV - (ADM8511) – C:\WINDOWS\system32\drivers\ADM8511.SYS (ADMtek Incorporated)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\..\URLSearchHook: {472734EA-242A-422b-ADF8-83D1E48CC825} - Reg Error: Key error. File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

FF - HKLM\software\mozilla\Mozilla Firefox 3.5.18\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/03/27 14:29:55 | 000,000,000 | -H-D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.18\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/03/23 14:24:54 | 000,000,000 | -H-D | M]

[2009/10/26 14:16:37 | 000,000,000 | -H-D | M] (No name found) – C:\Documents and Settings\Ryan B\Application Data\Mozilla\Extensions
[2011/04/17 18:47:54 | 000,000,000 | -H-D | M] (No name found) – C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\extensions
[2009/12/02 22:23:30 | 000,000,000 | -H-D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/04/17 18:48:04 | 000,000,000 | -H-D | M] (Support.com Toolbar) – C:\Documents and Settings\Ryan B\Application Data\Mozilla\Firefox\Profiles\gsusvlym.default\extensions\[removed]
[2011/04/17 12:15:35 | 000,000,000 | -H-D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2010/01/23 19:10:11 | 000,000,000 | -H-D | M] (Move Media Player) – C:\DOCUMENTS AND SETTINGS\RYAN B\APPLICATION DATA\MOVE NETWORKS
[2009/09/12 22:08:29 | 000,000,000 | -H-D | M] (Java Quick Starter) – C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2007/04/16 13:07:12 | 000,180,293 | -H– | M] () – C:\Program Files\Mozilla Firefox\plugins\npViewpoint.dll

O1 HOSTS File: ([2011/04/18 13:50:57 | 000,000,027 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\DLA\DLASHX_W.DLL (Sonic Solutions)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE (Sonic Solutions)
O4 - HKLM..\Run: [ISTray] File not found
O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exe (SigmaTel, Inc.)
O4 - HKLM..\Run: [WebrootTrayApp] C:\Program Files\Webroot\Security\Current\Framework\WRTray.exe (Webroot Software, Inc. )
O4 - HKCU..\Run: [Aim6] C:\Program Files\AIM6\aim6.exe (AOL LLC)
O4 - HKCU..\Run: [HDFryVTMFjAtTWN] File not found
O4 - HKCU..\Run: [Messenger (Yahoo!)] C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited)
O4 - HKCU..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_15)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\Ryan B\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Ryan B\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/08/19 20:33:20 | 000,000,000 | -H– | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/04/19 22:57:49 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2011/04/19 20:51:53 | 000,000,000 | —D | C] – C:\ComboFix
[2011/04/18 20:40:06 | 000,000,000 | —D | C] – C:\Documents and Settings\Ryan B\Application Data\SUPERAntiSpyware.com
[2011/04/18 20:40:06 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
[2011/04/18 20:39:39 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\SUPERAntiSpyware
[2011/04/18 20:39:35 | 000,000,000 | —D | C] – C:\Program Files\SUPERAntiSpyware
[2011/04/18 20:39:13 | 010,917,928 | —- | C] (SUPERAntiSpyware.com) – C:\Documents and Settings\Ryan B\Desktop\SUPERAntiSpyware.exe
[2011/04/18 13:47:36 | 000,000,000 | —D | C] – C:\WINDOWS\temp
[2011/04/18 13:28:18 | 000,020,952 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2011/04/18 11:39:55 | 000,000,000 | —D | C] – C:\_OTL
[2011/04/18 11:38:22 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Ryan B\Recent
[2011/04/17 22:27:06 | 000,000,000 | -H-D | C] – C:\WINDOWS\System32\appmgmt
[2011/04/17 22:26:37 | 000,000,000 | —D | C] – C:\Config.Msi
[2011/04/17 18:47:54 | 000,000,000 | -H-D | C] – C:\Program Files\Ask.com
[2011/04/17 18:46:50 | 005,689,312 | -H– | C] (Support.com ) – C:\Documents and Settings\Ryan B\Desktop\ARO2011_tbt.exe
[2011/04/17 16:45:02 | 000,580,608 | -H– | C] (OldTimer Tools) – C:\Documents and Settings\Ryan B\Desktop\OTL.exe
[2011/04/17 16:40:39 | 007,734,240 | -H– | C] (Malwarebytes Corporation ) – C:\Documents and Settings\Ryan B\Desktop\mbam-setup.exe
[2011/04/12 23:41:35 | 000,000,000 | -H-D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Spybot - Search & Destroy
[2011/04/12 23:41:27 | 000,000,000 | -H-D | C] – C:\Program Files\Spybot - Search & Destroy
[2011/04/12 23:41:27 | 000,000,000 | -H-D | C] – C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
[2011/04/12 22:25:50 | 000,000,000 | -H-D | C] – C:\Program Files\GridinSoft Trojan Killer
[2011/04/12 12:46:48 | 000,000,000 | -HSD | C] – C:\WINDOWS\CSC
[2011/04/12 12:40:35 | 000,000,000 | -H-D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\SpywareBlaster
[2011/04/12 12:40:33 | 000,000,000 | -H-D | C] – C:\Program Files\SpywareBlaster
[2011/04/12 01:53:27 | 000,000,000 | -H-D | C] – C:\Program Files\Enigma Software Group
[2011/04/12 01:53:01 | 000,000,000 | -H-D | C] – C:\Program Files\Common Files\Wise Installation Wizard

========== Files - Modified Within 30 Days ==========

[2011/04/19 23:02:24 | 000,002,206 | -H– | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/04/19 23:01:01 | 000,000,236 | -H– | M] () – C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2011/04/19 23:00:48 | 000,000,882 | -H– | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/04/19 23:00:03 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/04/19 20:51:18 | 004,324,798 | R— | M] () – C:\Documents and Settings\Ryan B\Desktop\ComboFix.exe
[2011/04/18 20:39:40 | 000,001,678 | —- | M] () – C:\Documents and Settings\All Users\Desktop\SUPERAntiSpyware Free Edition.lnk
[2011/04/18 20:39:13 | 010,917,928 | —- | M] (SUPERAntiSpyware.com) – C:\Documents and Settings\Ryan B\Desktop\SUPERAntiSpyware.exe
[2011/04/18 20:31:01 | 000,000,886 | -H– | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/04/18 13:50:57 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2011/04/17 19:27:39 | 000,709,456 | —- | M] () – C:\WINDOWS\is-E7D5J.exe
[2011/04/17 19:27:39 | 000,010,562 | —- | M] () – C:\WINDOWS\is-E7D5J.msg
[2011/04/17 19:27:39 | 000,000,347 | —- | M] () – C:\WINDOWS\is-E7D5J.lst
[2011/04/17 18:46:50 | 005,689,312 | -H– | M] (Support.com ) – C:\Documents and Settings\Ryan B\Desktop\ARO2011_tbt.exe
[2011/04/17 16:45:05 | 000,580,608 | -H– | M] (OldTimer Tools) – C:\Documents and Settings\Ryan B\Desktop\OTL.exe
[2011/04/17 16:40:39 | 007,734,240 | -H– | M] (Malwarebytes Corporation ) – C:\Documents and Settings\Ryan B\Desktop\mbam-setup.exe
[2011/04/17 16:35:06 | 001,006,778 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\new1.exe
[2011/04/17 16:35:06 | 001,006,778 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\new.exe
[2011/04/12 23:41:35 | 000,000,951 | -H– | M] () – C:\Documents and Settings\Ryan B\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2011/04/12 23:41:35 | 000,000,933 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\Spybot - Search & Destroy.lnk
[2011/04/12 13:18:28 | 000,658,488 | -H– | M] () – C:\WINDOWS\System32\drivers\Cat.DB
[2011/04/12 13:14:50 | 000,512,992 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\sdasetup_revwire207.exe
[2011/04/12 12:40:35 | 000,000,690 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\SpywareBlaster.lnk
[2011/04/12 00:51:16 | 000,046,471 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\myc.jpg
[2011/04/11 16:08:47 | 000,435,828 | -H– | M] () – C:\WINDOWS\System32\perfh009.dat
[2011/04/11 16:08:47 | 000,068,558 | -H– | M] () – C:\WINDOWS\System32\perfc009.dat
[2011/03/28 22:26:50 | 005,084,128 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\03-young-modern-life.mp3
[2011/03/25 19:07:05 | 000,027,356 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\schoolpicture.jpg
[2011/03/23 14:39:59 | 000,030,756 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\after gym.jpg
[2011/03/21 23:33:04 | 000,021,652 | -H– | M] () – C:\Documents and Settings\Ryan B\Desktop\me4.jpg

========== Files Created - No Company Name ==========

[2011/04/18 20:39:40 | 000,001,678 | —- | C] () – C:\Documents and Settings\All Users\Desktop\SUPERAntiSpyware Free Edition.lnk
[2011/04/18 12:09:55 | 004,324,798 | R— | C] () – C:\Documents and Settings\Ryan B\Desktop\ComboFix.exe
[2011/04/17 19:27:39 | 000,709,456 | —- | C] () – C:\WINDOWS\is-E7D5J.exe
[2011/04/17 19:27:39 | 000,010,562 | —- | C] () – C:\WINDOWS\is-E7D5J.msg
[2011/04/17 19:27:39 | 000,000,347 | —- | C] () – C:\WINDOWS\is-E7D5J.lst
[2011/04/17 18:48:01 | 000,000,236 | -H– | C] () – C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2011/04/17 18:34:56 | 001,006,778 | -H– | C] () – C:\Documents and Settings\Ryan B\Desktop\new1.exe
[2011/04/17 16:35:02 | 001,006,778 | -H– | C] () – C:\Documents and Settings\Ryan B\Desktop\new.exe
[2011/04/12 23:41:35 | 000,000,951 | -H– | C] () – C:\Documents and Settings\Ryan B\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2011/04/12 23:41:35 | 000,000,933 | -H– | C] () – C:\Documents and Settings\Ryan B\Desktop\Spybot - Search & Destroy.lnk
[2011/04/12 13:18:12 | 000,658,488 | -H– | C] () – C:\WINDOWS\System32\drivers\Cat.DB
[2011/04/12 13:14:59 | 000,512,992 | -H– | C] () – C:\Documents and Settings\Ryan B\Desktop\sdasetup_revwire207.exe
[2011/04/12 12:40:35 | 000,000,690 | -H– | C] () – C:\Documents and Settings\Ryan B\Desktop\SpywareBlaster.lnk
[2011/04/12 00:51:15 | 000,046,471 | -H– | C] () – C:\Documents and Settings\Ryan B\Desktop\myc.jpg
[2011/03/28 21:51:16 | 005,084,128 | -H– | C] () – C:\Documents and Settings\Ryan B\Desktop\03-young-modern-life.mp3
[2011/03/25 19:07:03 | 000,027,356 | -H– | C] () – C:\Documents and Settings\Ryan B\Desktop\schoolpicture.jpg
[2011/03/23 14:39:58 | 000,030,756 | -H– | C] () – C:\Documents and Settings\Ryan B\Desktop\after gym.jpg
[2011/03/21 23:33:03 | 000,021,652 | -H– | C] () – C:\Documents and Settings\Ryan B\Desktop\me4.jpg
[2010/10/02 12:55:56 | 000,030,424 | -H– | C] () – C:\WINDOWS\System32\wrLZMA.dll
[2010/10/02 12:55:56 | 000,017,472 | -H– | C] () – C:\WINDOWS\System32\SsiEfr.exe
[2010/03/02 01:35:11 | 000,006,144 | -H– | C] () – C:\Documents and Settings\Ryan B\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/12/12 15:11:10 | 000,261,632 | -H– | C] () – C:\WINDOWS\PEV.exe
[2009/12/12 15:11:10 | 000,098,816 | -H– | C] () – C:\WINDOWS\sed.exe
[2009/12/12 15:11:10 | 000,080,412 | -H– | C] () – C:\WINDOWS\grep.exe
[2009/12/12 15:11:10 | 000,077,312 | -H– | C] () – C:\WINDOWS\MBR.exe
[2009/12/12 15:11:10 | 000,068,096 | -H– | C] () – C:\WINDOWS\zip.exe
[2009/09/18 20:13:37 | 000,000,664 | -H– | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2009/08/24 20:07:43 | 000,038,224 | —- | C] () – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/08/24 19:36:03 | 000,000,000 | -H– | C] () – C:\WINDOWS\nsreg.dat
[2009/08/24 17:44:11 | 000,086,016 | -H– | C] () – C:\WINDOWS\System32\preflib.dll
[2009/08/24 17:44:09 | 000,020,480 | -H– | C] () – C:\WINDOWS\System32\WLTRYSVC.EXE
[2009/08/24 17:44:08 | 000,757,760 | -H– | C] () – C:\WINDOWS\System32\bcm1xsup.dll
[2009/08/24 16:22:09 | 003,107,788 | -H– | C] () – C:\WINDOWS\System32\ativvaxx.dat
[2009/08/24 16:22:09 | 000,147,685 | -H– | C] () – C:\WINDOWS\System32\atiicdxx.dat
[2009/08/19 21:30:17 | 000,000,174 | -H– | C] () – C:\WINDOWS\wininit.ini
[2009/08/19 20:36:41 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2009/08/19 20:29:30 | 000,021,640 | -H– | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2009/08/19 16:15:27 | 000,004,161 | -H– | C] () – C:\WINDOWS\ODBCINST.INI
[2009/08/19 16:07:20 | 000,267,800 | -H– | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2005/11/18 14:47:26 | 000,000,000 | -H– | C] () – C:\WINDOWS\System32\px.ini
[2005/03/21 19:48:05 | 013,107,200 | -H– | C] () – C:\WINDOWS\System32\oembios.bin
[2005/03/21 19:48:05 | 000,004,627 | -H– | C] () – C:\WINDOWS\System32\oembios.dat
[2004/08/04 06:00:00 | 000,673,088 | -H– | C] () – C:\WINDOWS\System32\mlang.dat
[2004/08/04 06:00:00 | 000,435,828 | -H– | C] () – C:\WINDOWS\System32\perfh009.dat
[2004/08/04 06:00:00 | 000,272,128 | -H– | C] () – C:\WINDOWS\System32\perfi009.dat
[2004/08/04 06:00:00 | 000,218,003 | -H– | C] () – C:\WINDOWS\System32\dssec.dat
[2004/08/04 06:00:00 | 000,068,558 | -H– | C] () – C:\WINDOWS\System32\perfc009.dat
[2004/08/04 06:00:00 | 000,046,258 | -H– | C] () – C:\WINDOWS\System32\mib.bin
[2004/08/04 06:00:00 | 000,028,626 | -H– | C] () – C:\WINDOWS\System32\perfd009.dat
[2004/08/04 06:00:00 | 000,004,569 | -H– | C] () – C:\WINDOWS\System32\secupd.dat
[2004/08/04 06:00:00 | 000,001,804 | -H– | C] () – C:\WINDOWS\System32\dcache.bin
[2004/08/04 06:00:00 | 000,000,741 | -H– | C] () – C:\WINDOWS\System32\noise.dat

< End of report >

C:\Documents and Settings\Ryan B\Desktop\new1.exe

1 VT Community user(s) with a total of 1 reputation credit(s) say(s) this sample is goodware. 0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is malware.
File name: new1.exe
Submission date: 2011-04-20 03:12:07 (UTC)
Current status: queued queued analysing finished

Result: 12/ 41 (29.3%)
VT Community

goodware
Safety score: 100.0%

Compact Print results
Antivirus Version Last Update Result
AhnLab-V3 2011.04.20.00 2011.04.19 -
AntiVir 7.11.6.190 2011.04.20 -
Antiy-AVL 2.0.3.7 2011.04.19 Backdoor/Win32.Hupigon.gen
Avast 4.8.1351.0 2011.04.19 -
Avast5 5.0.677.0 2011.04.19 -
AVG 10.0.0.1190 2011.04.19 -
BitDefender 7.2 2011.04.20 -
CAT-QuickHeal 11.00 2011.04.19 (Suspicious) - DNAScan
ClamAV 0.97.0.0 2011.04.20 PUA.Packed.PECompact-1
Commtouch 5.3.2.6 2011.04.20 -
Comodo 8405 2011.04.20 -
DrWeb 5.0.2.03300 2011.04.20 -
eSafe 7.0.17.0 2011.04.18 Win32.Corrupt.Ag
eTrust-Vet 36.1.8280 2011.04.19 -
F-Prot 4.6.2.117 2011.04.19 -
F-Secure 9.0.16440.0 2011.04.20 -
Fortinet 4.2.257.0 2011.04.20 -
GData 22 2011.04.20 -
Ikarus T3.1.1.103.0 2011.04.20 -
Jiangmin 13.0.900 2011.04.18 Backdoor/Hupigon.bsdj
K7AntiVirus 9.97.4428 2011.04.19 -
Kaspersky 7.0.0.125 2011.04.20 -
McAfee 5.400.0.1158 2011.04.20 Artemis!3C33B26F2F7F
McAfee-GW-Edition 2010.1D 2011.04.20 Artemis!3C33B26F2F7F
Microsoft 1.6802 2011.04.20 -
NOD32 6056 2011.04.20 -
Norman 6.07.07 2011.04.19 -
Panda 10.0.3.5 2011.04.19 -
PCTools 7.0.3.5 2011.04.19 -
Prevx 3.0 2011.04.20 High Risk Spyware
Rising 23.54.01.06 2011.04.19 Trojan.Win32.Generic.128583D6
Sophos 4.64.0 2011.04.20 NirCmd
SUPERAntiSpyware 4.40.0.1006 2011.04.20 -
Symantec 20101.3.2.89 2011.04.20 -
TheHacker 6.7.0.1.177 2011.04.19 Backdoor/Hupigon.nmkk
TrendMicro 9.200.0.1012 2011.04.19 -
TrendMicro-HouseCall 9.200.0.1012 2011.04.20 -
VBA32 3.12.16.0 2011.04.19 Backdoor.Hupigon.nrvn
VIPRE 9066 2011.04.20 -
ViRobot 2011.4.19.4418 2011.04.19 -
VirusBuster 13.6.312.2 2011.04.19 -
Additional informationShow all
MD5 : 1429fff7a09b103e43613273c24b7781
SHA1 : 1f39d2b0fe8dc577115cb6881f237324bab009b6
SHA256: a27897272780ecfcba588c12d3a5f740be62f2345feab2a369522927008493f8
ssdeep: 24576:1LmfPSFQnYr8gTRvpqy9Xp7nqF24Vhtn+evXvu94lvekprhqQ:OPSuY8gFt957nqF2Wwe
vS4lvfprh9
File size : 1006778 bytes
First seen: 2011-03-24 01:34:57
Last seen : 2011-04-20 03:12:07
TrID:
UPX compressed Win32 Executable (39.5%)
Win32 EXE Yoda's Crypter (34.3%)
Win32 Executable Generic (11.0%)
Win32 Dynamic Link Library (generic) (9.8%)
Generic Win/DOS Executable (2.5%)
sigcheck:
publisher….: n/a
copyright….: n/a
product……: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments…..: n/a
signers……: -
signing date.: -
verified…..: Unsigned

packers (F-Prot): RAR, PecBundle, PECompact, UPX, Unicode
packers (Kaspersky): UPX, PE_Patch.PECompact, PecBundle, PECompact, UPX, PE_Patch.PECompact, PecBundle, PECompact, UPX, UPX, PE_Patch.PECompact, PecBundle, PECompact, UPX, UPX, UPX, UPX
PEInfo: PE structure information

[[ basic data ]]
entrypointaddress: 0x471C0
timedatestamp….: 0x4B9DD366 (Mon Mar 15 06:27:50 2010)
machinetype……: 0x14c (I386)

[[ 3 section(s) ]]
name, viradd, virsiz, rawdsiz, ntropy, md5
UPX0, 0x1000, 0x3B000, 0x0, 0.00, d41d8cd98f00b204e9800998ecf8427e
UPX1, 0x3C000, 0xC000, 0xB400, 7.90, e1dbc898317a295eeac907944610818a
.rsrc, 0x48000, 0x23000, 0x22400, 7.72, b361986dc4796919e394ee830575b834

[[ 9 import(s) ]]
KERNEL32.DLL: LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree, ExitProcess
ADVAPI32.dll: RegCloseKey
COMCTL32.dll: -
COMDLG32.dll: GetSaveFileNameA
GDI32.dll: DeleteDC
ole32.dll: OleInitialize
OLEAUT32.dll: -
SHELL32.dll: SHGetMalloc
USER32.dll: GetDC

Prevx Info:
http://info.prevx.com/aboutprogramtext.asp…2D5C90048744735
ExifTool:
file metadata
CodeSize: 49152
EntryPoint: 0x471c0
FileSize: 983 kB
FileType: Win32 EXE
ImageVersion: 0.0
InitializedDataSize: 143360
LinkerVersion: 9.0
MIMEType: application/octet-stream
MachineType: Intel 386 or later, and compatibles
OSVersion: 5.0
PEType: PE32
Subsystem: Windows GUI
SubsystemVersion: 4.0
TimeStamp: 2010:03:15 07:27:50+01:00
UninitializedDataSize: 241664

VT Community

1
User:Anonymous
Reputation:1 credits
Comment date:2011-04-01 06:25:39 (UTC)
This file saved my laptop from a nasty rouge anti-spyware trojan. See here:
http://www.bleepingcomputer.com/download/anti-virus/rkill

C:\Documents and Settings\Ryan B\Desktop\new.exe

1 VT Community user(s) with a total of 1 reputation credit(s) say(s) this sample is goodware. 0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is malware.
File name: new.exe
Submission date: 2011-04-20 03:18:00 (UTC)
Current status: queued (#35) queued analysing finished

Result: 12/ 41 (29.3%)
VT Community

goodware
Safety score: 100.0%

Compact Print results
Antivirus Version Last Update Result
AhnLab-V3 2011.04.20.00 2011.04.19 -
AntiVir 7.11.6.190 2011.04.20 -
Antiy-AVL 2.0.3.7 2011.04.19 Backdoor/Win32.Hupigon.gen
Avast 4.8.1351.0 2011.04.19 -
Avast5 5.0.677.0 2011.04.19 -
AVG 10.0.0.1190 2011.04.19 -
BitDefender 7.2 2011.04.20 -
CAT-QuickHeal 11.00 2011.04.19 (Suspicious) - DNAScan
ClamAV 0.97.0.0 2011.04.20 PUA.Packed.PECompact-1
Commtouch 5.3.2.6 2011.04.20 -
Comodo 8405 2011.04.20 -
DrWeb 5.0.2.03300 2011.04.20 -
eSafe 7.0.17.0 2011.04.18 Win32.Corrupt.Ag
eTrust-Vet 36.1.8280 2011.04.19 -
F-Prot 4.6.2.117 2011.04.19 -
F-Secure 9.0.16440.0 2011.04.20 -
Fortinet 4.2.257.0 2011.04.20 -
GData 22 2011.04.20 -
Ikarus T3.1.1.103.0 2011.04.20 -
Jiangmin 13.0.900 2011.04.18 Backdoor/Hupigon.bsdj
K7AntiVirus 9.97.4428 2011.04.19 -
Kaspersky 7.0.0.125 2011.04.20 -
McAfee 5.400.0.1158 2011.04.20 Artemis!3C33B26F2F7F
McAfee-GW-Edition 2010.1D 2011.04.20 Artemis!3C33B26F2F7F
Microsoft 1.6802 2011.04.20 -
NOD32 6056 2011.04.20 -
Norman 6.07.07 2011.04.19 -
Panda 10.0.3.5 2011.04.19 -
PCTools 7.0.3.5 2011.04.19 -
Prevx 3.0 2011.04.20 High Risk Spyware
Rising 23.54.01.06 2011.04.19 Trojan.Win32.Generic.128583D6
Sophos 4.64.0 2011.04.20 NirCmd
SUPERAntiSpyware 4.40.0.1006 2011.04.20 -
Symantec 20101.3.2.89 2011.04.20 -
TheHacker 6.7.0.1.177 2011.04.19 Backdoor/Hupigon.nmkk
TrendMicro 9.200.0.1012 2011.04.19 -
TrendMicro-HouseCall 9.200.0.1012 2011.04.20 -
VBA32 3.12.16.0 2011.04.19 Backdoor.Hupigon.nrvn
VIPRE 9066 2011.04.20 -
ViRobot 2011.4.19.4418 2011.04.19 -
VirusBuster 13.6.312.2 2011.04.19 -
Additional informationShow all
MD5 : 1429fff7a09b103e43613273c24b7781
SHA1 : 1f39d2b0fe8dc577115cb6881f237324bab009b6
SHA256: a27897272780ecfcba588c12d3a5f740be62f2345feab2a369522927008493f8

mowman

Post #15April 20, 2011, 8:33 AM UTC

Please do the following

1.We need to disable Spybot teatimer,i have put the instructions below,if you are unable to do this uninstall Spybot for now and reinstall when we are finished.
2.Uninstall Malwarebytes,download a fresh copy and see if the scan will run
3.Run ESET scan
4Tell me where we are at with the computer after doing the above.

SPYBOT TEATIMER

Launch Spybot S&D, go to the Mode menu and make sure "Advanced Mode" is selected.
On the left hand side, click on Tools, then click on the Resident Icon in the list.
Uncheck the "Resident "TeaTimer" (Protection of overall system settings) active." box.
Click on the "System Startup" icon in the List
Uncheck the "TeaTimer" box and "OK" any prompts.
If Teatimer gives you a warning that changes were made, click the "Allow Change" box when prompted.
Exit Spybot S&D when done and reboot your computer.
(When we are done, you can re-enable Teatimer using the same steps but this time place a check next to "Resident TeaTimer" and check the "TeaTimer" box in System Startup.]

lease download Malwarebytes from Here or Here

Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform quick scan, then click Scan.
[external image: Posted Image]
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected .
When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.

Post the log please

Run the following scan: Eset Online Scanner

Place a check mark in the box YES, I accept the Terms Of Use
Click the Start button.
Now click the Install button.
Click Start. The scanner engine will initialize and update.
Place a check mark in the box beside Remove found threats.
Click the Scan button. The scan will now run, please be patient.
When the scan finishes click the Details tab.
Copy and paste the contents of the C:\ProgramFiles\EsetOnlineScanner\log.txt into your next reply.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Fake Windos Restore took over laptop

✨ Ask AI

Ask AI